9c9a5b48379bc3746557057de57fda7a63961cce82d72ec8ff88c6ce2ca2c172

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 18:52

Target

TerrariaFIX.V2/OnlineFix.dll
Size

4.7MB
MD5

df02427a7dd0e238185e05eddf780ef2
SHA1

30ea45123498c573efb25e23a322da3e88eba560
SHA256

ecc9a3b09c204cf231d30dfa599d72fdea48ab3608a70bc3e96226c730593bac
SHA512

3da491bca8f8e0a3b17cf85edc1af7134f76ecf0ceeab0bbd18403839c40a44ef34c2e9db4a10e895632c45db612aeb738a67a66b8587220010fdab8c83cd3db
SSDEEP

98304:lUBzT+aFcfuQMcJrWUAVArmRNqHfZWDiqIBzH6HgMfxT+MOQmL:ilTLUutOrWUAVkm2/ZWOdL3Cxqom

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2224	2248	rundll32.exe	28
PID 2248 wrote to memory of 2224	2248	rundll32.exe	28
PID 2248 wrote to memory of 2224	2248	rundll32.exe	28
PID 2248 wrote to memory of 2224	2248	rundll32.exe	28
PID 2248 wrote to memory of 2224	2248	rundll32.exe	28
PID 2248 wrote to memory of 2224	2248	rundll32.exe	28
PID 2248 wrote to memory of 2224	2248	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TerrariaFIX.V2\OnlineFix.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TerrariaFIX.V2\OnlineFix.dll,#1
  2⤵
  PID:2224

memory/2224-0-0x0000000073A10000-0x000000007426C000-memory.dmp

Filesize
8.4MB

Download