7bc23223c8f81d70c230ceac3deb05670e9778974fd285b8cae1e693c2367de4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 12:22

Target

DontBearWithCheaters/xxhash.dll
Size

47KB
MD5

19081ff52c0c21e888c2795f42200215
SHA1

ef8528891c7250111cc3592baf162006f0607c7f
SHA256

f291117a848583a74bd0546511715a293a9b87d4c2a250bf431f98f1bb20de6c
SHA512

cfaa8c1ea5145870b88ef0b299d67e6f902cadfbbbab03d6843e1e65bdebe37ba463b200041c64bb191c5f907d559c2df52756290031d33876a79665ef31d3e4
SSDEEP

768:D1WkmhW508rbV9uoF6QV8nBT+RYOsYeZbK9DSPItsrXzhqcqOMLOC:D1aW5BrbuHbnBiGO9SbTISXzhqcqOMa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3024	1940	rundll32.exe	30
PID 1940 wrote to memory of 3024	1940	rundll32.exe	30
PID 1940 wrote to memory of 3024	1940	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DontBearWithCheaters\xxhash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1940 -s 80
  2⤵
  PID:3024