0f0d91b9f5fff3f9106753b914ec92aceefdcb223ddcd3ccacffa9f7adbfef08

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 21:19

Target

CheatEvolution/lua/dlls/MonoDataCollector32.dll
Size

407KB
MD5

c5b870ce07da5206d8a81e139920b7dc
SHA1

f868450ed5f886f084c00345c75143c65fd9338e
SHA256

eb26b38a604cf98b95a39fd249c0771e351061a9894d22284cdfe984e8fc7a6c
SHA512

7dfb3e9940ec0d14b42c77483f71274701c46483e65ee57a0853a31f688cc5c3d0c0af2050229ba196d9beff9813f259e3f92eec9d8352cc0e416feb4eb1a6be
SSDEEP

12288:CLM9vziuDEVmqU2Im5/P1OhGKexP+gVuQ:lLiuDEV15/tVP+ouQ

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2024	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	2024	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2024	1524	rundll32.exe	28
PID 1524 wrote to memory of 2024	1524	rundll32.exe	28
PID 1524 wrote to memory of 2024	1524	rundll32.exe	28
PID 1524 wrote to memory of 2024	1524	rundll32.exe	28
PID 1524 wrote to memory of 2024	1524	rundll32.exe	28
PID 1524 wrote to memory of 2024	1524	rundll32.exe	28
PID 1524 wrote to memory of 2024	1524	rundll32.exe	28
PID 2024 wrote to memory of 2696	2024	rundll32.exe	29
PID 2024 wrote to memory of 2696	2024	rundll32.exe	29
PID 2024 wrote to memory of 2696	2024	rundll32.exe	29
PID 2024 wrote to memory of 2696	2024	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CheatEvolution\lua\dlls\MonoDataCollector32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CheatEvolution\lua\dlls\MonoDataCollector32.dll,#1
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 240
    3⤵
    - Program crash
    PID:2696