ee1fcfce4a8f3349c6f78e52eff179f51e95e69665e43a32fa1e76a7674d18cf

Analysis

max time kernel
149s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 02:19

Target

Crimson Skies/GAME/GOSDATA/ASSETS/BINARIES/LANGUAGE.dll
Size

32KB
MD5

863fee725ffd7241e21b991bfd3c3950
SHA1

b05ad6f3a7915ddb428893f45afb3c6b1f4181aa
SHA256

2d7c904bb2d7b14aa03f5df38bb9df61da756f9263af57786b9d1da4e30f6072
SHA512

7fa513e83609caf768270f281fc535b23364d5f60f41a2a416bad572e42a9a990a13fe99ede15223d3e3b879c79a4fc1f0df6b642b1388131437f048d3f92f0e
SSDEEP

384:HKdw8pTet8y3rfjOkmlYrjylyxuROQsoIo9NTNdFf+r0:HF8pTepbfjDWpROQFIo99fFf+o

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 1676	3652	rundll32.exe	93
PID 3652 wrote to memory of 1676	3652	rundll32.exe	93
PID 3652 wrote to memory of 1676	3652	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crimson Skies\GAME\GOSDATA\ASSETS\BINARIES\LANGUAGE.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crimson Skies\GAME\GOSDATA\ASSETS\BINARIES\LANGUAGE.dll",#1
  2⤵
  PID:1676