1b5d30bce50cc61abb82169d482ad7d0fd9ed9f7dddc30555c8115b324c18f22

Resubmissions

01/09/2024, 21:48

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 21:48

Target

Skate 3 RPCS3 Save Editor.exe
Size

80KB
MD5

7a47a3df90fc3785a2779b6160a41ab6
SHA1

fb4e05e515d205748f2f8f5d9d1bc38ff970711b
SHA256

1b5d30bce50cc61abb82169d482ad7d0fd9ed9f7dddc30555c8115b324c18f22
SHA512

46145b2063a62a16cbc070e20786c2860cc872ee0bc76967c83ba57d16cec608ebbcac54a964ae2d37c6e20011523a7b98cf489780daa3f6e392c939056010f0
SSDEEP

1536:Q7l4jeDaAxP81nTHpXeWciH8QaCK4ZloVRlM/6BZZFY4DUlY58o9O4lrrLhgBV48:GAl8lWY5N9O4l9gBV416

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2776	2180	Skate 3 RPCS3 Save Editor.exe	30
PID 2180 wrote to memory of 2776	2180	Skate 3 RPCS3 Save Editor.exe	30
PID 2180 wrote to memory of 2776	2180	Skate 3 RPCS3 Save Editor.exe	30

C:\Users\Admin\AppData\Local\Temp\Skate 3 RPCS3 Save Editor.exe
"C:\Users\Admin\AppData\Local\Temp\Skate 3 RPCS3 Save Editor.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2180 -s 528
  2⤵
  PID:2776

memory/2180-0-0x000007FEF6323000-0x000007FEF6324000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x000000013F1F0000-0x000000013F208000-memory.dmp

Filesize
96KB

Download