0dd72c3b6bc6767b10eabf060d5bb2e971bc2912767b95f7547548dabaf7de56

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 12:10

Target

RobuxGifter/_internal/VCRUNTIME140.dll
Size

116KB
MD5

be8dbe2dc77ebe7f88f910c61aec691a
SHA1

a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256

4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512

0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP

1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2852	2876	rundll32.exe	30
PID 2876 wrote to memory of 2852	2876	rundll32.exe	30
PID 2876 wrote to memory of 2852	2876	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RobuxGifter\_internal\VCRUNTIME140.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 80
  2⤵
  PID:2852