49053f17a978ad0d704ba7aa14540542c88053175806686c2df02eeec00ecd59

Analysis

max time kernel
23s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07-07-2023 03:30

Target

FMODGMS.dll
Size

180KB
MD5

be68f44a1b532da3ec52ca1ba4c6d7d4
SHA1

214e6c4ed11b10db523718e2f1fbf16ad7a24de3
SHA256

9d1de6c1e9262048eb4c417ed9fe497cc7548ede802475f079345c0f7cd9335c
SHA512

e94a2eb628c1bd3f7bae2c311c3b74c4cb159cf16ce2d45bfeea9fb8233b31711fbdd3d51ff9b5cd5e2e9fd0877faa349481afd8817a50b800ce7ce26b65a859
SSDEEP

3072:NAucEC4pE4a8bsP/f3A/0n72LRGkYu9biUXI/yfnGsAg0FuXVrt73VBDrSYg:KucECtq0n34kCLQkYEmRPsAOFrJlprSF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1480	2316	rundll32.exe	28
PID 2316 wrote to memory of 1480	2316	rundll32.exe	28
PID 2316 wrote to memory of 1480	2316	rundll32.exe	28
PID 2316 wrote to memory of 1480	2316	rundll32.exe	28
PID 2316 wrote to memory of 1480	2316	rundll32.exe	28
PID 2316 wrote to memory of 1480	2316	rundll32.exe	28
PID 2316 wrote to memory of 1480	2316	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FMODGMS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FMODGMS.dll,#1
  2⤵
  PID:1480