eb14c6a2b0207e62fb7256311f3c6d5198d58f23a680143326edb5eb4ba48c3c

Analysis

max time kernel
156s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 18:12

Target

gtasawallhack.dll
Size

467KB
MD5

53fd07c554a352d6a5b34c251506a3cc
SHA1

a2bda4ea0159118d4dae265eca89a0cd0869d8da
SHA256

eb14c6a2b0207e62fb7256311f3c6d5198d58f23a680143326edb5eb4ba48c3c
SHA512

76424386221268f6222028cbc83a936bf1e2408187b958b81453802340e78e1c8f2cbc5bc8bcc451a0956584c120ea9e5f2bafaf76500c7da9d61d5f847a8443
SSDEEP

3072:TxAFG+ak2oNFciURLT9Z+7D/3I8azVewo9ZfINen9gbf4dBDMGg2mpswHQJ+EfYt:u0w2B+l9gBsBVeQRORMsZ6DYZx0A

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1036	2652	rundll32.exe	84
PID 2652 wrote to memory of 1036	2652	rundll32.exe	84
PID 2652 wrote to memory of 1036	2652	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\gtasawallhack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\gtasawallhack.dll,#1
  2⤵
  PID:1036