34c35e5e18354f9e459e792a3f8bb40af5b18787f0461078ba563b5d49aa6292

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 22:32

Target

Clanwar1.0/GameStatDota.dll
Size

206KB
MD5

210df8ea08e0c6a919257f536fd9e08e
SHA1

f2198581bac169cce0510a1986c93d1b55ce0977
SHA256

b8bb590544b854d371aa5e7137aebde184e7d706861090cc391f774268e8806e
SHA512

f4bc057f1efe337a310b077a8712918ccad19f74d3452431467bc7e00583b1f5d46187975bb251a8260fc696e8e115b0425636e238e22edbb156fc6603515595
SSDEEP

3072:taPuC/zl1+p/4XG3KeKgXmxKZGaJiiXyxAScUxgaWXxz7Sp5AFwYU:tap+p/eI/XmxK0JAScUxgHu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4612	3956	rundll32.exe	85
PID 3956 wrote to memory of 4612	3956	rundll32.exe	85
PID 3956 wrote to memory of 4612	3956	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\GameStatDota.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Clanwar1.0\GameStatDota.dll,#1
  2⤵
  PID:4612