c208f52ca1873007df3f7ef71b61f3c2870a58ad0ddadff7944785f6bf36de23

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 19:14

Target

Lunar Engine/libmikmod32.dll
Size

289KB
MD5

dacd337030c240f324a3d655ecd876e2
SHA1

d108dcbd13ca07265085278c61d8a9f751a4905e
SHA256

041427d5ae979b938fc2771bf3ae6e2b0cf6a669fc881b44be1586e46225532b
SHA512

83f0343479ea0f92fa48264b70efbdafa5d54f3bce5e0b8be523cdf528eb7891754208e48e7f14df554c2832cf9758377542f9df0eba8c441ccb8cacbfbab08f
SSDEEP

3072:iQMsoykzuYV4SPaa/Gr+RBmRQ5wipE04CIcFw6eAwE5Sm1Q5jsV+Kzhzr2M:iNJyTuxkC57IZEz1RiM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2192	2188	rundll32.exe	28
PID 2188 wrote to memory of 2192	2188	rundll32.exe	28
PID 2188 wrote to memory of 2192	2188	rundll32.exe	28
PID 2188 wrote to memory of 2192	2188	rundll32.exe	28
PID 2188 wrote to memory of 2192	2188	rundll32.exe	28
PID 2188 wrote to memory of 2192	2188	rundll32.exe	28
PID 2188 wrote to memory of 2192	2188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Engine\libmikmod32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lunar Engine\libmikmod32.dll",#1
  2⤵
  PID:2192