0c7f13d75cd6aedf9a95973a1e4b4e16f1e497d5032b4355d62c2365f2bd04a6

Resubmissions

04/09/2024, 06:11

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 06:11

Target

Balatro.Friends of Jimbo-P2P/love.dll
Size

4.6MB
MD5

db1d05295d7ad48180541aa2b962485f
SHA1

dcfa0ecc58087731b1d445ec676054032d45a5b7
SHA256

f8d5d7e976ecc0ecf1870b5fcf4d25cdf9bd3621445a8b8fea54cb4ad5d79816
SHA512

291b9b40cdbcfe4ede2d3899d30830a69c10d52663ab00d5b0a00bf0f2de4acddb0d2597248c37780dd5300caa3c22065c69c7a668cfca013f29c47c55f3a4a4
SSDEEP

49152:QOo0+OeZdwU+wnY7ZIh16+rdrKyW92YelbtDbEatI4Pd6237GMcKSLgfTuGRSalC:zI39xbDg/YSR3L0w/C

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2124	2364	rundll32.exe	31
PID 2364 wrote to memory of 2124	2364	rundll32.exe	31
PID 2364 wrote to memory of 2124	2364	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Balatro.Friends of Jimbo-P2P\love.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2364 -s 184
  2⤵
  PID:2124