12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
363s
max time network
377s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
02/08/2023, 23:39

Target

Common Files/AudioUtil.dll
Size

9KB
MD5

370ae6e5f71405d90723a4c3f111a45a
SHA1

7b08ea97ff71c8d8399edbcdcac8b2edb95215b4
SHA256

273431a282fd63cd056ef4a404df1f83af450e26e1c9bf281c1e1849807fff63
SHA512

62c9b4c36f075020ac70af863e1edb6da1129062f244a4035ed2c1d293456fe5efad348a0fe6a07e0adb790e2a04d0bb388e262e5681147f8c92eab0286a0237
SSDEEP

96:doCYelueVlue1H2QRQfkoe4gElPC5ehuAk8folfGNqkT7Mc2sLxNnm1woq:PRlueVluepiCZEpfcpuN1T7Mc2ELmiT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2656	2640	rundll32.exe	28
PID 2640 wrote to memory of 2656	2640	rundll32.exe	28
PID 2640 wrote to memory of 2656	2640	rundll32.exe	28
PID 2640 wrote to memory of 2656	2640	rundll32.exe	28
PID 2640 wrote to memory of 2656	2640	rundll32.exe	28
PID 2640 wrote to memory of 2656	2640	rundll32.exe	28
PID 2640 wrote to memory of 2656	2640	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\AudioUtil.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\AudioUtil.dll",#1
  2⤵
  PID:2656