9f3f956525cecd7c4fb922f884a0deb3e151b9e23c98f08788939dfe18575dfa

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:16

Target
fraps32.dll
Size 228KB
Sample240612-29b2psvcjg
SHA256 d972834a5a97fcff4d521f93f36966f9a1710591db98c0b4bf7e4dc383783391
MD5 45920db266fda29a23f73ba8a8a3a13a
SHA1 f0c6d13065fb4cb8f944ce44870414d5a20db93d
SHA512 f600bfc631d8f6f4d8315c48c754b163975dbcc606f49a20f3bc41a7c493fcdd2db40cf018f369ad565915b2af539cf9e0cdbb0f5cca35f700c51de231d69d9c
SSDEEP 3072:sG+tisHDjPxt9ZUKkmjZqZfZ4KaBKuw9x+N7AahfaksCn:sjDb9PkmH9BKB9x+lAnrCn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 1836	4592	rundll32.exe	82
PID 4592 wrote to memory of 1836	4592	rundll32.exe	82
PID 4592 wrote to memory of 1836	4592	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fraps32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fraps32.dll,#1
  2⤵
  PID:1836