0c7f13d75cd6aedf9a95973a1e4b4e16f1e497d5032b4355d62c2365f2bd04a6

Resubmissions

04/09/2024, 06:11

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 06:11

Target

Balatro.Friends of Jimbo-P2P/msvcr120.dll
Size

940KB
MD5

9c861c079dd81762b6c54e37597b7712
SHA1

62cb65a1d79e2c5ada0c7bfc04c18693567c90d0
SHA256

ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c
SHA512

3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7
SSDEEP

24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2184	2692	rundll32.exe	28
PID 2692 wrote to memory of 2184	2692	rundll32.exe	28
PID 2692 wrote to memory of 2184	2692	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Balatro.Friends of Jimbo-P2P\msvcr120.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2692 -s 80
  2⤵
  PID:2184