bb76d76af8aeb847aa6ba37f3eed8cd71a5c3824d624e7115ca1ecd56a3d68b7

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 14:19

Target

Lethal Company/Lethal Company/BepInEx/patchers/BepInEx.MonoMod.HookGenPatcher/MonoMod.RuntimeDetour.HookGen.exe
Size

23KB
MD5

cedeb2d79ce46b05ef9cda878c61c447
SHA1

294eb246e76fe87d3a4fb87fd86a343605067d25
SHA256

79b2c4cef86328a482f4edc9a5973895f19d3f59566d4b57b0080bdf1872e802
SHA512

9abae10a828e6348cdd04029264df82fb07262318a79b0dc19822651afaf17a506a09158c706773feaf28b5b300b3b9f673164b8e018b4b565566bc3f5ddcb11
SSDEEP

384:aDqsgskJ/x0q6IJB0R3cCVIp/66pcThCsgAOeTs1Hblknp7A9tnncnOMuKriLq1j:aDqsgxJZzJyRcbp//pcmcs5bFtnFMuKB

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2072	2348	MonoMod.RuntimeDetour.HookGen.exe	29
PID 2348 wrote to memory of 2072	2348	MonoMod.RuntimeDetour.HookGen.exe	29
PID 2348 wrote to memory of 2072	2348	MonoMod.RuntimeDetour.HookGen.exe	29

C:\Users\Admin\AppData\Local\Temp\Lethal Company\Lethal Company\BepInEx\patchers\BepInEx.MonoMod.HookGenPatcher\MonoMod.RuntimeDetour.HookGen.exe
"C:\Users\Admin\AppData\Local\Temp\Lethal Company\Lethal Company\BepInEx\patchers\BepInEx.MonoMod.HookGenPatcher\MonoMod.RuntimeDetour.HookGen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 376
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2072

memory/2072-4-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2348-0-0x000007FEF5C7E000-0x000007FEF5C7F000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download
memory/2348-2-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-3-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-5-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-6-0x000007FEF5C7E000-0x000007FEF5C7F000-memory.dmp

Filesize
4KB

Download