068e727f7a752a65815025756376baa1ae5622a6518cf8056764cfffa7d0b815

Resubmissions

01/10/2024, 19:40

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 19:40

Target

cheat-Client-18.4/libcrypto-3-x64.dll
Size

4.4MB
MD5

a15b6cad89e6490154d7f036be729318
SHA1

137538525ef14c136b088395a75d75af6e072b82
SHA256

872d68f01c79c3da3d795c18c353ef182bfc7f26acc43e6fbd7752e4e05bd87d
SHA512

8b8239f32553f38ec22f4d8327e98ad03cbb7be12ec90a1772df3683674f4452411c8e483d09a00b0eceaf9737b58a2e2822f9ea0b3ced2a523fac974edfb86e
SSDEEP

98304:CY+5Wk9nTWDHa6PgZmQdJNPw1CPwDvt3uFFZC:f+Wk9Tn6PgZmQdJNo1CPwDvt3uFFZC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2452	1404	rundll32.exe	31
PID 1404 wrote to memory of 2452	1404	rundll32.exe	31
PID 1404 wrote to memory of 2452	1404	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cheat-Client-18.4\libcrypto-3-x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1404 -s 88
  2⤵
  PID:2452