d1132df2f76ce5a708ccf760732953f04f7922aecb2b86e9a5b1dd35494da72c

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 00:46

Target

LDSGamePlayerPK/LudashiEmulator.dll
Size

430KB
MD5

d03abf8f5716a2873a5d6244d596826f
SHA1

6989a1be22ce112484459472708f59b880842538
SHA256

e70bc77297f915a34c72f4dc809cf18799b17272afeb994b7f5c16d86991c96c
SHA512

d7c8e18a507bdf87aff42fc3b164ec042c327bbab51543bba50012b2a107f77b7475a94d56d45bfc246c00a4b3113c4a39afc383c51059fc3b95a5d021173db0
SSDEEP

6144:PNp86HT8uQLkT4+AHcOHhDL0VmBKP4EpbAOwAOT/5rLcP:PUqT8bkMzAmMP4EpbCxRrLcP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3060 wrote to memory of 2432	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2432	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2432	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2432	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2432	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2432	3060	rundll32.exe	rundll32.exe
PID 3060 wrote to memory of 2432	3060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LDSGamePlayerPK\LudashiEmulator.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LDSGamePlayerPK\LudashiEmulator.dll,#1
  2⤵
  PID:2432