0c7f13d75cd6aedf9a95973a1e4b4e16f1e497d5032b4355d62c2365f2bd04a6

Resubmissions

04-09-2024 06:11

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-09-2024 06:11

Target

Balatro.Friends of Jimbo-P2P/msvcp120.dll
Size

644KB
MD5

46060c35f697281bc5e7337aee3722b1
SHA1

d0164c041707f297a73abb9ea854111953e99cf1
SHA256

2abf0aab5a3c5ae9424b64e9d19d9d6d4aebc67814d7e92e4927b9798fef2848
SHA512

2cf2ed4d45c79a6e6cebfa3d332710a97f5cf0251dc194eec8c54ea0cb85762fd19822610021ccd6a6904e80afae1590a83af1fa45152f28ca56d862a3473f0a
SSDEEP

12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2588	2880	rundll32.exe	30
PID 2880 wrote to memory of 2588	2880	rundll32.exe	30
PID 2880 wrote to memory of 2588	2880	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Balatro.Friends of Jimbo-P2P\msvcp120.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2880 -s 80
  2⤵
  PID:2588