a346595fe9232e039e99763b5fab73cb11383d9d8ec5cbafd861e84fb376e30d

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 11:37

Target

AMR Player/bass.dll
Size

96KB
MD5

8741c1669550d89bc781dfa5ac11da8b
SHA1

d083e66010aa0f884ad80823384e7f50c3eaaf68
SHA256

91dabc42430075dd6b29a143a6cbed02e2135b3db9f76bd90ddd7621a13da54d
SHA512

e7d0a0bf6852eb9ec24bf1e9e7546276469e6445437e949507facfc22009e3dc82994d6e9ed9aaeff9fc90c89507f325e47344d22d00d04238205873ce24fb01
SSDEEP

1536:jYcrMnh/DhwDXL0vhRZ9KEsgAL6OeUko/wToQUe4E8Gf6cp5WDXLbfYEjr/9:s+Mh/dzZg5gfTgSoq4PGScpkLbh

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 276 wrote to memory of 1216	276	rundll32.exe	28
PID 276 wrote to memory of 1216	276	rundll32.exe	28
PID 276 wrote to memory of 1216	276	rundll32.exe	28
PID 276 wrote to memory of 1216	276	rundll32.exe	28
PID 276 wrote to memory of 1216	276	rundll32.exe	28
PID 276 wrote to memory of 1216	276	rundll32.exe	28
PID 276 wrote to memory of 1216	276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AMR Player\bass.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\AMR Player\bass.dll",#1
  2⤵
  PID:1216

memory/1216-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download