c6909f1359e14113e0cd1e5fdf720c81da53fc235e3b8ed99c7ba620c25ec62b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 03:02

Target

0604/game.dll
Size

328KB
MD5

cda8145935ba0dc4dc52ca42b651404f
SHA1

7d0bfd0ce6f3db44b2eeccc210c3a2af6fd70ef6
SHA256

18b7beb2fbcde82430ac70640b3f078c5a733b7b9af17d475dbdc84f0242342e
SHA512

1796a9c8a174b8a3dd1a0277137937dd8fc62a2113332ca304d10f5cf098b86d44c12822eb4a586063f0506b72655468f6daf4e61a317fb456a8f14a7faeca70
SSDEEP

3072:0nTuE77/7q1TslVx4ScyV1VxpA/ujnR8q3VXnQTcmh519ej0JPozAfVJLWRu9LUE:mrFkSRlxWujp5vm+UVJiu9LURV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4884	3180	rundll32.exe	83
PID 3180 wrote to memory of 4884	3180	rundll32.exe	83
PID 3180 wrote to memory of 4884	3180	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0604\game.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0604\game.dll,#1
  2⤵
  PID:4884

memory/4884-0-0x0000000010000000-0x0000000010061000-memory.dmp

Filesize
388KB

Download