406a23ff989e9ea29398993c0842f5a0202c3cffa54ef2fa21798767624d4719

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 14:15

Target

Fraps/data/Lib/Lib5.dll
Size

97KB
MD5

eeaa4f54953ba5b601ffec89cd451a70
SHA1

29126eb0895223a176781f8b025165669d7c5de9
SHA256

0d60d9bd7b8bdfa0d5623aebfe5684c8e29c305a4ee590e3933effa8cb7664b0
SHA512

9a33494e203444576991767d5c83a33a13068764e4c5da58714f60ffa3421f8ea940c26423786586eaacc29aa4317ceae0cb80b5937004f00a89ba6ca6b01ad1
SSDEEP

1536:y1rEn2kxYT233UJec6lre5j2RUTYaKbF7GykTWxsWMHcd/MAuVOLM:y1ry37c6lK5j2Rg5ykN2/nuVO4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2080	2924	rundll32.exe	89
PID 2924 wrote to memory of 2080	2924	rundll32.exe	89
PID 2924 wrote to memory of 2080	2924	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fraps\data\Lib\Lib5.dll,#1
  2⤵
  PID:2080