0980866e95e873e3b5f9132d69701d206adb8fbb14cdbb4d576b7c2901064719

Analysis

max time kernel
138s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 07:34

Target

YYHeZi1.0.9.1985/Voice/Effects/Simple/Impl/Chorus.dll
Size

56KB
MD5

2d9562b3f83723fbd8cb85807dcbe926
SHA1

59cb544bb803b497ac331fad6e52796833d90c0e
SHA256

3cdd0d48afe39b1d3b960aae674fecbfbc72bf12ebdc4aa36d835ed0a959be2b
SHA512

ba17566fc73234d8c0db183dd1bcf383f1592a3b9429865f85e155859045e152c065821107dea7ffffb6fea2a1572c27bad8c9925e7d919948401252f3813a25
SSDEEP

768:MNU8qNgA5slq/VATCjQwIsU/l0jnohcgEGiB9uoF6ZdJV3rikoQaQWg:MNtq7PATCj0MouwTV5oQwg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3304	2352	WerFault.exe	33

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2352	5112	rundll32.exe	33
PID 5112 wrote to memory of 2352	5112	rundll32.exe	33
PID 5112 wrote to memory of 2352	5112	rundll32.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YYHeZi1.0.9.1985\Voice\Effects\Simple\Impl\Chorus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\YYHeZi1.0.9.1985\Voice\Effects\Simple\Impl\Chorus.dll,#1
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 616
    3⤵
    - Program crash
    PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2352 -ip 2352
1⤵
PID:448