fbe07d1afd27ab353daa2afacc2de87d8f5ec69f64bbd9246f31ebfe1731de9b

Analysis

max time kernel
446s
max time network
455s
platform
windows10-2004_x64
resource
win10v2004-20240412-es
resource tags

arch:x64arch:x86image:win10v2004-20240412-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
22-04-2024 19:58

Target

$TEMP/PCSX2 1.6.0/Plugins/GSdx32-SSE4.dll
Size

2.1MB
MD5

3b211b8662b7ad58d666ca4fcb11c037
SHA1

b6dc98be6e107a8fe3559eb42f0f293191fb18aa
SHA256

6634ca468c9b2468136c990f3c14f243293ea435e123735a9f67d659e9c5c9c1
SHA512

800f2f57a66206c2614f2375fbc600b86d707067a3886ffb57122ad5ca3fa4f5e4cd9e46ea7002f6bb5990f12931543195faa5d014518280dc67a888c90a10e0
SSDEEP

49152:ZkM9Nb66KyDkzS1zvT/GBI0Rj+60kJVi10M03IvPJ60JU0WJ46:ZRNb1TDAS1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2424 wrote to memory of 3912	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 3912	2424	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 3912	2424	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Plugins\GSdx32-SSE4.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Plugins\GSdx32-SSE4.dll",#1
  2⤵
  PID:3912