0c7f13d75cd6aedf9a95973a1e4b4e16f1e497d5032b4355d62c2365f2bd04a6

Resubmissions

04-09-2024 06:11

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-09-2024 06:11

Target

Balatro.Friends of Jimbo-P2P/https.dll
Size

63KB
MD5

d86732797537f128799f4753ccd39436
SHA1

b3b0e5e7eabc0ac9289a305be70ccc1351a39bd8
SHA256

8a704c903575c2dbbc109869d179e8213d2574885f3f429173869dd75620b39c
SHA512

0d76d319f6fac139185af7c9d843b3376bc7ad217c4aea41c8f8192a34d536cf8aced600bd7fecc764235bda176e51e8d031cb953def1135600e5c78cc281bac
SSDEEP

768:cWfyHGDlnwyEv91+AS2qQYpadRTXMX7RUPpKWsohqlGjtG9A0jVGUUXHwUo0J:cWfyHEmvA2SpCBMX7RUgpiGSHwUom

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2668	2104	rundll32.exe	30
PID 2104 wrote to memory of 2668	2104	rundll32.exe	30
PID 2104 wrote to memory of 2668	2104	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Balatro.Friends of Jimbo-P2P\https.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2104 -s 112
  2⤵
  PID:2668