f85d3900aad4bbb99fdfc389cd039eb4fc9840889284aba7d7c2cd754300d514

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 12:41

Target

CreamAPI/log_build/windows/steam_api.dll
Size

756KB
MD5

bab060e3fb98bfab60003089eff3714b
SHA1

cc4da99649d45cc0c4006aa6b45cea82118521c2
SHA256

8d237dfa23c199ad04f586a9ef2b7221e96fb697daf09987b638663b9a20aa9d
SHA512

ed73a594e1d48a65e5efabde53fc17bc5078300954362e7fa08d97cd23350a4d37216e5185e7565ba71a450f4cdcfc044a57e9f1c6704808414725077b7066d0
SSDEEP

12288:6Ejiwk6sIPT5RKquFpFpweznWYNfkBcTPodKMWApWof6dN6eZ5thy8fCzKzC7H:NiwkXFGezWIfkBcPowMWApFf6dN68xyT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28
PID 2784 wrote to memory of 2460	2784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CreamAPI\log_build\windows\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CreamAPI\log_build\windows\steam_api.dll,#1
  2⤵
  PID:2460