c291f69fe2c0a95a9949ac15d06182344d646cf591752e0db27e2a09c90a97e6

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 10:12

Target

garrysmod/lua/bin/gmcl_gwater2_main_win32.dll
Size

279KB
MD5

aa6712e1f56217b7692e8c74ebaab8de
SHA1

018520ec39588cbc0220b5e2c8f8532c2c860259
SHA256

11376ceea6baf2cf8db399e832dfb65c026dca582827f4b01f4a9fd939dbfbd0
SHA512

5a816f9423899390cf839ba82e7adf69069061746562adb66b7c99e17fc4f999bc15bfae1ce93d2e771d1222d3008bfc1e26a955b69069b1949704dbcf10b112
SSDEEP

6144:6V0bKDxfdKPldui8Jk1XHgqwW0UFjJtB1xW2c:6DBdnnJGXHgqwW0US2c

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1460	2428	rundll32.exe	30
PID 2428 wrote to memory of 1460	2428	rundll32.exe	30
PID 2428 wrote to memory of 1460	2428	rundll32.exe	30
PID 2428 wrote to memory of 1460	2428	rundll32.exe	30
PID 2428 wrote to memory of 1460	2428	rundll32.exe	30
PID 2428 wrote to memory of 1460	2428	rundll32.exe	30
PID 2428 wrote to memory of 1460	2428	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\garrysmod\lua\bin\gmcl_gwater2_main_win32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\garrysmod\lua\bin\gmcl_gwater2_main_win32.dll,#1
  2⤵
  PID:1460