0f13a8f8ea33976e45bc96ce40408648cd0e812dcd8b626d6721d0da34d30d3f

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 11:54

Target

Rise Cheats R6 Project/Protect32.dll
Size

740KB
MD5

dd2f9afc6fea0018cac6d472f0d7f508
SHA1

342b48e2a2a0e8a83f59f33ab0818457ef1f07ec
SHA256

dd0f87533a44f5c2d03913ac644db0910b6dda322175dce0ae3d37b19e773d27
SHA512

17a458d3bf8dcb96909839b08553ec57cd6e8f25e0882c94a291f478bf778a9f085f73a89c74cf80f8a92ce692596ae06fb533db09125b33dc8f888a0a9310aa
SSDEEP

12288:FvEVgqt188uV2KxRi6Vcpinf+OeO+OeNhBBhhBBqFQ6vv/ynB+hrMZ/2l3vq5:FvEwLRWkpFQ6v8B+SZ/Y3vi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3536	4284	rundll32.exe	82
PID 4284 wrote to memory of 3536	4284	rundll32.exe	82
PID 4284 wrote to memory of 3536	4284	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rise Cheats R6 Project\Protect32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Rise Cheats R6 Project\Protect32.dll",#1
  2⤵
  PID:3536