ef124cf26c5bf40de1051ef2fa9c397fbe457aa961dc40886250827c2ad74d44

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 10:04

Target

Turb0z's Simple Mutli Hack [ESP_ Triggerbot_ Aimbot]/msvcr120d.dll
Size

1.7MB
MD5

3a285feb516e97b0d58c1634acd19431
SHA1

02c5b342ce3057ec8e528b3710bb3801e3ee9dab
SHA256

84bc7d0ddf835bbcc1cd6cc59f2daf23215db42b1ea6c1b9d450490408e5d36b
SHA512

b432991bd174eae10fa155e139cc0d06a82119b7a34c744f3a5a8661e4d7b1fc5b81e06833808b10372e9105d705436dd499e55c7b5127fa253d8a21c43c8706
SSDEEP

24576:ORUo0F7qe5IKP+kHLlU5uhk/z/cFGdLqRp+dcF/9RjJpkbV9eblglZqAntrJzyoH:Vo0RhkIsd2RZ1syglomXOtZuF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	4008	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 4008	2868	rundll32.exe	86
PID 2868 wrote to memory of 4008	2868	rundll32.exe	86
PID 2868 wrote to memory of 4008	2868	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Turb0z's Simple Mutli Hack [ESP_ Triggerbot_ Aimbot]\msvcr120d.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Turb0z's Simple Mutli Hack [ESP_ Triggerbot_ Aimbot]\msvcr120d.dll",#1
  2⤵
  PID:4008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 600
    3⤵
    - Program crash
    PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4008 -ip 4008
1⤵
PID:648