b0f676f29e958a2b569442e554b8798dd0f74cbe6379c3ef8e95e7320ab54606

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 06:08

Target

Electric Shock Academy/GameAssembly.dll
Size

28.4MB
MD5

1bd47d430016caab59d628cdf8fcb976
SHA1

4df5ca813ee0c8e196d05231ec7c878c38bca5f9
SHA256

bb42f91deec9ea948959d7ffbb532a46c1f783122be5835f9575b6c0c36812b2
SHA512

51522adcdc69310e2ed22afaa4f9088eaa4965a865b333342eb32603ef13f240b156dd92dc364e3a5c893b4855b93aff07c949ea7ab5761d3297a2f1d676a0af
SSDEEP

393216:+TkMnLAFExiHBkiowK9qh09VRAdrjp3W7Jhe3BxdauFEQS:ELuExikwOe34uFE

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2896	2376	rundll32.exe	31
PID 2376 wrote to memory of 2896	2376	rundll32.exe	31
PID 2376 wrote to memory of 2896	2376	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Electric Shock Academy\GameAssembly.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2376 -s 260
  2⤵
  PID:2896