177eb704df67eb4982a6f125fb2b57342e80db27f9bfeea8ff76d8e8ef318801

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 01:05 UTC

Target

resources/binaries/blitz-overlay.dll
Size

3.7MB
MD5

bb537b580e1753d0a0490afc38a56bd5
SHA1

141499e874250027e94d5e280652b34bac75172e
SHA256

1d3583315cdd6270eed99b468b9a92a44ee6897870b6b200b1af9e2f5c0fc068
SHA512

ab6a3a266220f4bfd4f60966b71cd85b1afcf3236c3ec007a647e9d2f5c486dc5084ab6071328dfce6486c7a0c9c31bad55488bf66fad96a1791777fd778c757
SSDEEP

49152:spA9xvXm2lePxGAHNMC9xdI6PYvsn5Nx0WIzyNk8P2OQyXmkTiZGy:KAhaFxa2x0uNV2WXmkTWGy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3012	2964	rundll32.exe	28
PID 2964 wrote to memory of 3012	2964	rundll32.exe	28
PID 2964 wrote to memory of 3012	2964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz-overlay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2964 -s 148
  2⤵
  PID:3012