0c7f13d75cd6aedf9a95973a1e4b4e16f1e497d5032b4355d62c2365f2bd04a6

Resubmissions

04-09-2024 06:11

max time kernel
140s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04-09-2024 06:11

Target

Balatro.Friends of Jimbo-P2P/luasteam.dll
Size

189KB
MD5

3a9684714ccd9f25a9a6d94de9972f8b
SHA1

694380cc1b4fe03d6d7def8384b9ec6c62ae2949
SHA256

737d63541c206e5f88298022c48c7205b0fc72a07cf051a354a6fae2bcd88f49
SHA512

d227eec2d8bfca1afef5bc89a5b6a1ee81edc731793fa4bf91edfd824f3b3bc969bf663b18de97aa0ee2d3b999ae40e2a81a1d9a828f0324c5a0880fc5a037a2
SSDEEP

3072:WXEgpcnvT+hGh9D9z3rQ4Glx4XHz/Y0kyDp1VhfYfPkuZMgRs:8OsGh9DhEHlqD+E1wkCJi

Score

1^/10

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2372	2076	rundll32.exe	30
PID 2076 wrote to memory of 2372	2076	rundll32.exe	30
PID 2076 wrote to memory of 2372	2076	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Balatro.Friends of Jimbo-P2P\luasteam.dll",#1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2076 -s 184
  2⤵
  PID:2372

memory/2076-0-0x000007FEF62D0000-0x000007FEF63E3000-memory.dmp

Filesize
1.1MB

Download
memory/2076-3-0x00000000776A1000-0x00000000776A2000-memory.dmp

Filesize
4KB

Download
memory/2076-5-0x0000000077650000-0x00000000777F9000-memory.dmp

Filesize
1.7MB

Download
memory/2076-4-0x0000000077650000-0x00000000777F9000-memory.dmp

Filesize
1.7MB

Download
memory/2076-6-0x000007FEF62D0000-0x000007FEF63E3000-memory.dmp

Filesize
1.1MB

Download
memory/2076-7-0x0000000077650000-0x00000000777F9000-memory.dmp

Filesize
1.7MB

Download
memory/2076-8-0x00000000776A1000-0x00000000776A2000-memory.dmp

Filesize
4KB

Download