76abf90f3575a023b53226ad1e4a3fe46eb409450a99ad97e53eed1912ade9cc

Analysis

max time kernel
122s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 21:29

Target

EA DLC Unlocker v2/origin/version.dll
Size

188KB
MD5

2ef99a682256f6b9820b876a9eb2950a
SHA1

fcd5b03210b3e0dbddd2146e66a245079dc843ac
SHA256

cf784476719a93e3fb8457a2d4c4580b691b6d04592b9a4467acf563f30d2b83
SHA512

757f1e48c3087a2bc31aa6f2573c01a21f460029090fedb03794aa63f5d49c5e6ce853bf8a57e450e211ddf83dc9eee32f8958e99e36945c5578aff5a8111e36
SSDEEP

3072:6znwT/WEMkaq3i/6+svlWTRlYOcWtAlxKm1aCk99X6tCq4OIhUujzlmZtcbdB2eo:WwT9qqMZsId+OcWOPa7dVqJujzGAwuCP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 1508	1132	rundll32.exe	85
PID 1132 wrote to memory of 1508	1132	rundll32.exe	85
PID 1132 wrote to memory of 1508	1132	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\origin\version.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\EA DLC Unlocker v2\origin\version.dll",#1
  2⤵
  PID:1508