63830c580968c7446bb9f94dd7919625ddd82e85e3314d5a33d28bd54d0c8076

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2024 20:52

Target

Combat arms Nx hack 2012/MSVCP60D.dll
Size

504KB
MD5

52a5636fd97d83d6ee60c5db70a7aadf
SHA1

6de04508e27dd7022a4d4826b0f15d702fdd9f8a
SHA256

68deb8cad3c055beebd3748aaed06e8ad4a365c18ac198ac6bc7c3ac7cd3496f
SHA512

48125ac52e7795919847b7c58b1c730b3b8d843734f6d469a0b18168c77b71ee8f1f841f0775e71c67b4aed5e19eb7d12a8c11f87a6d9a8ca77de34c1bca62fd
SSDEEP

12288:JygHEPY6hY5jIXVcOm+kqEzcM+X9jktiuq3OoxHkC9w:gVcOm/1+X9jktXq3OoxHkC9w

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2960	4808	rundll32.exe	14
PID 4808 wrote to memory of 2960	4808	rundll32.exe	14
PID 4808 wrote to memory of 2960	4808	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Combat arms Nx hack 2012\MSVCP60D.dll",#1
1⤵
PID:2960

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Combat arms Nx hack 2012\MSVCP60D.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4808