4e7c224b406e6b9623bd4fe627215bcbf017d7c29244cf86536c702af23ba573

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 14:12

Target

Craftomation.101/game/sdkencryptedappticket64.dll
Size

1008KB
MD5

76a1969f0dd5e1fd3a455679320a9405
SHA1

8a187ab8c604518f8fce1932aa72162df5593d96
SHA256

e385d0543e3c6d816164c4edcc54866ec40744282743b62ca6e450d0a9f92cc5
SHA512

2ab4cbcdfb5d6f978b8184b4e460f0222c5d7225472f6199db6c212c2b8b26cb5a04d54da2ea047c403bcb1338ecfb382b0cc24163d34c7f237b17a53e1db59c
SSDEEP

24576:bfGlrS6+xaTk+0/oB1Dv9nbbSKsyBnFvf/p7iTKtrDu:bGlrS6Yz+0/CDv9nbbSKsknFvp7iarq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2588	860	rundll32.exe	28
PID 860 wrote to memory of 2588	860	rundll32.exe	28
PID 860 wrote to memory of 2588	860	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Craftomation.101\game\sdkencryptedappticket64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 860 -s 80
  2⤵
  PID:2588