48a8bf00f2776ab6569babd10ac28e90c49b663890e16ba32fb7be77f16487e5

Analysis

max time kernel
140s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2024 09:39

Target

Enter.the.Gungeon.v2.1.9/Enter.the.Gungeon.v2.1.9/steam_api.dll
Size

1.2MB
MD5

18f1462ac04e9cfa08a0412df6025449
SHA1

b0f7258ccfd01f3fbfcb68e9b3e1416a05beae00
SHA256

5432b15f9a081e807fa3d22f982d51c60d5a683d31cc467180d73726fb9f182d
SHA512

96de56597da5f33fc44098eb5389baff29b47aefba44ea141e0d20afec307bb39b4084f99eeb0d392a6702c3508e63ceee09c9704d1033441e0ee3446e37a4db
SSDEEP

24576:4N6jAk67BG5ZQ9myvJrKcL+qXpyNpGiKPCtDYWEcMMZLcZ1oq/bSyNCqqpsnkoaI:F8NBc+8yBrKcL+BpGxgkW1uZ1oq/BCVL

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral26/memory/1800-0-0x00000000741C0000-0x0000000074FF8000-memory.dmp	upx
behavioral26/memory/1800-1-0x00000000741C0000-0x0000000074FF8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2968 wrote to memory of 1800	2968	rundll32.exe	rundll32.exe
PID 2968 wrote to memory of 1800	2968	rundll32.exe	rundll32.exe
PID 2968 wrote to memory of 1800	2968	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Enter.the.Gungeon.v2.1.9\Enter.the.Gungeon.v2.1.9\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Enter.the.Gungeon.v2.1.9\Enter.the.Gungeon.v2.1.9\steam_api.dll,#1
2⤵
PID:1800

memory/1800-0-0x00000000741C0000-0x0000000074FF8000-memory.dmp

Filesize
14.2MB

Download
memory/1800-1-0x00000000741C0000-0x0000000074FF8000-memory.dmp

Filesize
14.2MB

Download