59f0c094091505062f443e72c7f20faea6333de746cd2bcdf7b2616970b02f26

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 23:33

Target

Steam cheat engine/Files cheat/CED3D11Hook.dll
Size

137KB
MD5

42e2bf4210f8126e3d655218bd2af2e4
SHA1

78efcb9138eb0c800451cf2bcc10e92a3adf5b72
SHA256

1e30126badfffb231a605c6764dd98895208779ef440ea20015ab560263dd288
SHA512

c985988d0832ce26337f774b160ac369f2957c306a1d82fbbffe87d9062ae5f3af3c1209768cd574182669cd4495dba26b6f1388814c0724a7812218b0b8dc74
SSDEEP

1536:onOLYqoZQBD3m7bmVLcuVGpGXlWXQznQN8erRxQEmsYOT1GlERbo3iV8n/7DkCWy:o4YqoZNHi7VBAXvXMZ7ll3iyn3WOR3Oc

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2824	2244	rundll32.exe	28
PID 2244 wrote to memory of 2824	2244	rundll32.exe	28
PID 2244 wrote to memory of 2824	2244	rundll32.exe	28
PID 2244 wrote to memory of 2824	2244	rundll32.exe	28
PID 2244 wrote to memory of 2824	2244	rundll32.exe	28
PID 2244 wrote to memory of 2824	2244	rundll32.exe	28
PID 2244 wrote to memory of 2824	2244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Steam cheat engine\Files cheat\CED3D11Hook.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Steam cheat engine\Files cheat\CED3D11Hook.dll",#1
  2⤵
  PID:2824