f85d3900aad4bbb99fdfc389cd039eb4fc9840889284aba7d7c2cd754300d514

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 12:41

Target

CreamAPI/nonlog_build/windows/steam_api.dll
Size

666KB
MD5

3dd6f774b64ba9f1c12a0caad801e4cb
SHA1

b03b9b02942d9a9503017ba2506e96499a2bbc25
SHA256

2a2d381efb98e63e6ee42fe4e430f1556b70bd5542c0f7dd76b6413660c9b393
SHA512

881157968bc713d2ec69d8450114e96031e95bcc00b13e55e5e621aff6a0ac6ac55d1d5b0efbdc867d9118a67e0a89ad6a9db82cd320bd744d8e7ebb36a7a59a
SSDEEP

12288:XEXNTMX74WDONZ+n6hb3XluzLhAy1H2tSi0x7OUPKQJDg26dN6QWNMOxy8fCSvp0:XE9sw+6hbluzLhlhyS5x7hyQJDg26dNV

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28
PID 1992 wrote to memory of 2668	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CreamAPI\nonlog_build\windows\steam_api.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CreamAPI\nonlog_build\windows\steam_api.dll,#1
  2⤵
  PID:2668