12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
442s
max time network
451s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02-08-2023 23:39

Target

Common Files/AudioUtil.dll
Size

9KB
MD5

370ae6e5f71405d90723a4c3f111a45a
SHA1

7b08ea97ff71c8d8399edbcdcac8b2edb95215b4
SHA256

273431a282fd63cd056ef4a404df1f83af450e26e1c9bf281c1e1849807fff63
SHA512

62c9b4c36f075020ac70af863e1edb6da1129062f244a4035ed2c1d293456fe5efad348a0fe6a07e0adb790e2a04d0bb388e262e5681147f8c92eab0286a0237
SSDEEP

96:doCYelueVlue1H2QRQfkoe4gElPC5ehuAk8folfGNqkT7Mc2sLxNnm1woq:PRlueVluepiCZEpfcpuN1T7Mc2ELmiT

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4672	228	rundll32.exe	84
PID 228 wrote to memory of 4672	228	rundll32.exe	84
PID 228 wrote to memory of 4672	228	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\AudioUtil.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\AudioUtil.dll",#1
  2⤵
  PID:4672