7242b11b1978099e71d392d2c891b0b4a6bf669ce5a423a922a117f00902ffab

Analysis

max time kernel
59s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/04/2023, 01:56

Target

huzuni/huzuni-natives-1366200127757461/OpenAL32.dll
Size

381KB
MD5

9e02334f9bba622885eadb059f0633b3
SHA1

ede381bf55e7d0cd3a7e058237bbc66a8ff63837
SHA256

baf27fc91dc852d78889e052cfc9ed2b6fc0927258bb507a895c6fcd50f10fef
SHA512

066eaaee241976d99e3f11de415976fb0e47e97035d4d7a7c121c33882190f3546637650f841a2858ac1734655f4994dc2cb8c5bdda5828557485fc20a779def
SSDEEP

6144:qB0wNMEdGJE5cN8PLJ8I1kabGLPwrWr+JervPI6YXaZ8AO8+H1MOi7BU:qBDL+af1kabGL/r+JwvPjKaZ8NMO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1728	2532	rundll32.exe	83
PID 2532 wrote to memory of 1728	2532	rundll32.exe	83
PID 2532 wrote to memory of 1728	2532	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\huzuni\huzuni-natives-1366200127757461\OpenAL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\huzuni\huzuni-natives-1366200127757461\OpenAL32.dll,#1
  2⤵
  PID:1728