fcba6631b46e0e12601c371b19d1d4a3c8209c8b70831e548f23ef89a648dc9b

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 18:21

Target

Balatro.v1.0.0L-Unleashed/mpg123.dll
Size

212KB
MD5

1063bdbb4cff2f688e77df90b1873b01
SHA1

917beda2a65f64a089fbcff75620319df0893924
SHA256

a58a87086194c25e6f13318cb4b4eb63030e936a835f9740a773d9a421264cf5
SHA512

d2f1683d8682c7153e92164570dad11d404544487a6af178098dd71c9f25424662f926feba24929862ba8cd17f5f7f6b49614bdeb83aa9f90ccaf374efd42faa
SSDEEP

3072:VTpbCxfWMQjwP/3PsBrfSImZZ2h2sbj3R7pk1O0b1IRYd7hj9eqWxzQ962ij:VTpfGImZZ2h2sbj3R7eTI8d9MxE91i

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1940	928	rundll32.exe	28
PID 928 wrote to memory of 1940	928	rundll32.exe	28
PID 928 wrote to memory of 1940	928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Balatro.v1.0.0L-Unleashed\mpg123.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 928 -s 92
  2⤵
  PID:1940