5affb89cc24a412b6ae555fc41074165fd530bcb4d62a0b69244baf3b20e78c1

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2024 06:21

Target

GameClient.dll
Size

1.4MB
MD5

c3de7de2760e086fdaaae8e8db5872da
SHA1

4fbf1abbe30769228039932c2a14c7f489fe8b44
SHA256

bc7dfe61e9280a4128273ed4b26dc9573836d7506e2827cca0ee42a9b32170c7
SHA512

aac15c6e354e77c16c61a396180bf8219fc7c405d6c23b5412f6af4f93cada339f04e4b29ebda3370587dfa3aef51798ad21f9794574f630716f8dbd8eb37e31
SSDEEP

24576:j77JpCcl9bJPCiVlRdQIT2qaxYBVKgo0MYPpNO/qWIfV2+6+1Kr4l58b4dl0Gkpa:j71w2O4fBVFrIFSrKr3b+nM7dkYE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 4320	2640	rundll32.exe	86
PID 2640 wrote to memory of 4320	2640	rundll32.exe	86
PID 2640 wrote to memory of 4320	2640	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GameClient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GameClient.dll,#1
  2⤵
  PID:4320

memory/4320-0-0x0000000010000000-0x00000000103D5000-memory.dmp

Filesize
3.8MB

Download