0e24b8e9026309ce107cc22c3e37d189b3491a500c0282e029da324733772051

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 08:24

Target

Plugins/CPS3_Emu_Fix.dll
Size

52KB
MD5

d785f0c141d247b4f1b1aa8a33fbd589
SHA1

84cfa7301301dc3883fdbb608af54855affe4bc0
SHA256

205cef8cf34baeff3e077254ed2c4861abd1e9768d248c136a1455c2a2f3007f
SHA512

1c61cd9be2e5b7640468d2a57bfca80165a04b04c7ccca24a4f0d04c83740033ed6f9a94c5641b4dbf80852efd07140a9271f30369e4d3220f220ef87568c9eb
SSDEEP

384:isWAiINtLS/6oTzkw2tg+IEgXDhYN9mBZYsOs7xROr+ZS1Q5ZHQrBRwG27bgIeuX:isYIETzOgDZYjsA+UQ3a8/0ZY0Vt+

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2288	828	rundll32.exe	28
PID 828 wrote to memory of 2288	828	rundll32.exe	28
PID 828 wrote to memory of 2288	828	rundll32.exe	28
PID 828 wrote to memory of 2288	828	rundll32.exe	28
PID 828 wrote to memory of 2288	828	rundll32.exe	28
PID 828 wrote to memory of 2288	828	rundll32.exe	28
PID 828 wrote to memory of 2288	828	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\CPS3_Emu_Fix.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\CPS3_Emu_Fix.dll,#1
  2⤵
  PID:2288