c291f69fe2c0a95a9949ac15d06182344d646cf591752e0db27e2a09c90a97e6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 10:12

Target

garrysmod/lua/bin/gmcl_gwater2_win32.dll
Size

312KB
MD5

e016f76496c7d0b27483b871bb49dad7
SHA1

0dc7150d6c4cbe6bf6a895c9c05104e3570799ca
SHA256

2fc25cef3651a930be2159ff10da7d3ff80b7825fc7f48f0c590b4c3f166a83a
SHA512

06ca2ecdd3bd1510b402f09af6f3f8218fd4e4a379b43577525a2b80f4321478df72519054dcdabb101d33571f0d4c1180a07b76e6184f12a621259c4081c72f
SSDEEP

6144:8V03LIExfdRs7LCqEl9UB0Bb1PDsYigE7L1R+bAOkDppd:VkEBdMCN9UB0BBPD2gAUiNpd

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30
PID 2548 wrote to memory of 1604	2548	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\garrysmod\lua\bin\gmcl_gwater2_win32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\garrysmod\lua\bin\gmcl_gwater2_win32.dll,#1
  2⤵
  PID:1604