2883ca6aa4128eba9e009482d2e665ff528465c853e099aa87a9324fc343ff64

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 15:07

Target

Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Size

1015KB
MD5

c4dfbbd29f479ff9d9fc482022fbc43a
SHA1

b41a7f08625508a15c1ac085fe9fa136a04f0ed3
SHA256

afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634
SHA512

13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e
SSDEEP

12288:Cab/04n458xRrPzrUBHK5fhgxFmXEP2f7K46TnSEl1yt6zzng0LNU5R37A6Dv:Cl4n458xRrPztgxoGRNU5R37J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2064 wrote to memory of 1508	2064	rundll32.exe	rundll32.exe
PID 2064 wrote to memory of 1508	2064	rundll32.exe	rundll32.exe
PID 2064 wrote to memory of 1508	2064	rundll32.exe	rundll32.exe
PID 2064 wrote to memory of 1508	2064	rundll32.exe	rundll32.exe
PID 2064 wrote to memory of 1508	2064	rundll32.exe	rundll32.exe
PID 2064 wrote to memory of 1508	2064	rundll32.exe	rundll32.exe
PID 2064 wrote to memory of 1508	2064	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cheat_Bypass_1.6\Cheat_MTA\Bypass.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cheat_Bypass_1.6\Cheat_MTA\Bypass.dll,#1
2⤵
PID:1508