fcba6631b46e0e12601c371b19d1d4a3c8209c8b70831e548f23ef89a648dc9b

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 18:21

Target

Balatro.v1.0.0L-Unleashed/love.dll
Size

4.6MB
MD5

67a825a14ee72b670011722984852011
SHA1

0ff63efbdf8f47c0d5272f90654b1526adebb575
SHA256

18025808e7a184715d75bf49f4bfe24ffd5c2acc2702836e6ef3935b60f06b30
SHA512

789781baadd5346994a4cb1f8ff5aaa14cd7a9b8ea406b1197e14337d39e60d8e7dd2dc5763d3109b13b8a904064461a8323c38622ddaf974aa1b5337e69453e
SSDEEP

49152:4fKHp/lYNwY8EKjTcDL1FEXNRK/sQch2vjqoHXLZngdAJd26EaA+2P2COvz03QAh:ZcDQzwrqgr8VyNNVasfi/M2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28
PID 2932 wrote to memory of 2992	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Balatro.v1.0.0L-Unleashed\love.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2932 -s 176
  2⤵
  PID:2992