9a33ff3deea984165327d7334e3cffa8df23aebcc1d1c0aa144044a52df35421

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 09:52

Target

appdata/plugins/games/games.dll
Size

253KB
MD5

430afe4f16d5b5d1fd89e0e33a7949d0
SHA1

4191f45e27a45e278ea3f1978dd2ec5143ec8f03
SHA256

0bbc7e2e2479b5ae50d0b8f6842395c79541b6d5f71930806a50f3da5df86076
SHA512

6aae4bcc461c1d0d9c9b1958de448981712f39b6f09188a007d595e27e6ae806207d1ba4d45bb25593716d309a3118cd5876612a627df44f043d19f3f6d624ad
SSDEEP

3072:QD1qoLA+U0ORYD/Ul/xEANHF2G5UL4RH57SF0o/lmajuATIuGrahb4g5apoV8SgL:4Tkv0OaD8qSZUt9rTIHr6ap/

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28
PID 2180 wrote to memory of 2040	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\appdata\plugins\games\games.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\appdata\plugins\games\games.dll,#1
  2⤵
  PID:2040