4aab20889fea1250ebff86fd28bebdaa19cc310c496bcddcfdf2d3db56387a3c

Analysis

max time kernel
147s
max time network
279s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2024, 15:17

Target
resources/binaries/blitz-overlay.dll
Size 1.7MB
Sample240226-sn7rtahc33
SHA256 6af97585953a5ba4ebed672330d51eba208b94392807ec0a009a227ca1726da2
MD5 b7456f99600f4c7a2a60ac1b04281a69
SHA1 5bcc2a83dd4cc4474f09a8caadf3e242829933b8
SHA512 d135caa370cd4fb698e8b0f0afc83ba3fe5b277eeb276fc96f6260ef23f0e357fa1cc7f5518cfb5e3ec0802c5776d2c1775e95902061d30d19244c3712722a3c
SSDEEP 24576:l0LR2Gva1dreNTvIo1MGN/2n3g8PD+Fue2f00I7ZOxFkyPpHALT:GcSvI6MGN/2n3nyFP2M0WezpgLT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 868	3708	rundll32.exe	85
PID 3708 wrote to memory of 868	3708	rundll32.exe	85
PID 3708 wrote to memory of 868	3708	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz-overlay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\binaries\blitz-overlay.dll,#1
  2⤵
  PID:868