fcba6631b46e0e12601c371b19d1d4a3c8209c8b70831e548f23ef89a648dc9b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 18:21

Target

Balatro.v1.0.0L-Unleashed/lua51.dll
Size

554KB
MD5

e0e12c148ec7439f7f2d7b927e123942
SHA1

f0b88c9985195558e12bc00f8a31422861e73908
SHA256

29e5b0b67593ebb77e0f681ca0c2dbcba9efcecee7d71591f5c91be5760c963e
SHA512

35ca3de41a3eee6f99766682459e7808d17b37d92decae6cc4f960bb5219eceb6165ee21db8b038f5669f6852854e6c2c0a6e4104787031a2da52bd3f813cff2
SSDEEP

6144:QBqp9OvdK+PSbgI1qBK5tl1TUdxaE17SA7knaXMwEd3oBi60b0Nf0H8qdP1/Z:Kq+vd0hn1TSxaE17SA7YiEuBJI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1880	1724	rundll32.exe	28
PID 1724 wrote to memory of 1880	1724	rundll32.exe	28
PID 1724 wrote to memory of 1880	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Balatro.v1.0.0L-Unleashed\lua51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1724 -s 80
  2⤵
  PID:1880