fbe07d1afd27ab353daa2afacc2de87d8f5ec69f64bbd9246f31ebfe1731de9b

Analysis

max time kernel
446s
max time network
451s
platform
windows10-2004_x64
resource
win10v2004-20240412-es
resource tags

arch:x64arch:x86image:win10v2004-20240412-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
22-04-2024 19:58

Target

$TEMP/PCSX2 1.6.0/Plugins/LilyPad.dll
Size

160KB
MD5

aa051ec979c89401cab6ef88fd1a4dc1
SHA1

74859edd74277c2298cc2264b0a910aee842e6f0
SHA256

637def94c71ed72a9f04f1541fbffe4ab63f866461157e80ee90672fc380ada1
SHA512

5495125fdb8cc1544425e8a7c2e34f53094151b6449f348a2053ae94e25fe5d73a791b73d6045220adc0fdbd61fda4c6907c4eb12e8cb9c43a7668d912f2b1f3
SSDEEP

1536:u4ocUyhRRFD1a2vvPX6ILExBQVujvwTEt3KHMVMogxXefUdj0W8HPheYwrMneufa:aIqG/6qTq8MKogxXeboYnkm/J2MNKI8

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

3088 rundll32.exe

pid	process
3088	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3632 wrote to memory of 3088	3632	rundll32.exe	rundll32.exe
PID 3632 wrote to memory of 3088	3632	rundll32.exe	rundll32.exe
PID 3632 wrote to memory of 3088	3632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Plugins\LilyPad.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$TEMP\PCSX2 1.6.0\Plugins\LilyPad.dll",#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3088