2883ca6aa4128eba9e009482d2e665ff528465c853e099aa87a9324fc343ff64

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 15:07

Target
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Size 1015KB
Sample240304-shgy7sec86
SHA256 afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634
MD5 c4dfbbd29f479ff9d9fc482022fbc43a
SHA1 b41a7f08625508a15c1ac085fe9fa136a04f0ed3
SHA512 13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e
SSDEEP 12288:Cab/04n458xRrPzrUBHK5fhgxFmXEP2f7K46TnSEl1yt6zzng0LNU5R37A6Dv:Cl4n458xRrPztgxoGRNU5R37J
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 5096	2380	rundll32.exe	87
PID 2380 wrote to memory of 5096	2380	rundll32.exe	87
PID 2380 wrote to memory of 5096	2380	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cheat_Bypass_1.6\Cheat_MTA\Bypass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cheat_Bypass_1.6\Cheat_MTA\Bypass.dll,#1
  2⤵
  PID:5096