c0dbda45c45b1e123005dcf14ffa5ea790982232f0e63ffecc60de8441311508

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 13:24

Target

addons/sourcemod/bin/sourcemod.2.bms.dll
Size

522KB
MD5

887710d6d54c9b23bdf4102852c5be0c
SHA1

94ff4231c37283e27e6e44ff03c0af60cb6b03c4
SHA256

50016ea2b136958d58d7e0384ae5ead239e9d608b4dfcbadeba5da59211f28cb
SHA512

32e69db1a0801cccea77dd610d1d4e826818199a3b145cd51b8ee442e4b8ec31d2bc737b323e39d34db941d40a31633d330561627aa48d55fdb665c7bf96dad0
SSDEEP

12288:Gvtq2DS651iRMFpj/18xmPAT1k6RAlNcQsvqsVGzh3Q4/:Gvtq2DS65/paxmPAT1k6RUN2qCKH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 4116	1328	rundll32.exe	83
PID 1328 wrote to memory of 4116	1328	rundll32.exe	83
PID 1328 wrote to memory of 4116	1328	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\addons\sourcemod\bin\sourcemod.2.bms.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\addons\sourcemod\bin\sourcemod.2.bms.dll,#1
  2⤵
  PID:4116