8c8a1a0afaa57227b2aaeb8d58a458e091695eac98ff257e4b2a993db17375ae

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 16:22

Target

RodeMixer_Setup_beta/audio_filter/libscaletempo_plugin.dll
Size

32KB
MD5

79a0de5930046e2c66e73f34a3515e7f
SHA1

de6065163343ee5821eba90879d8fd5e323e3a52
SHA256

118747bbfeed2f8ea214ea144b458bc086094023e6bbc1b6dc1a882716bdae2a
SHA512

1ee8e9a98f9cb6c636e3fc763bc155b8202235f9038e1f7f3032f8b1ff91435476341f13626b81db68895187933043b248173178e995002f8e4294e3cf4947d6
SSDEEP

384:q6xNE8brweJ7ohcuabYogxgmamlheh4bVhthKZsHLAQYMhKZsHLsKfhS/:NK8HVwcN+RDlhhP7Z/hO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2260	1968	rundll32.exe	28
PID 1968 wrote to memory of 2260	1968	rundll32.exe	28
PID 1968 wrote to memory of 2260	1968	rundll32.exe	28
PID 1968 wrote to memory of 2260	1968	rundll32.exe	28
PID 1968 wrote to memory of 2260	1968	rundll32.exe	28
PID 1968 wrote to memory of 2260	1968	rundll32.exe	28
PID 1968 wrote to memory of 2260	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RodeMixer_Setup_beta\audio_filter\libscaletempo_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RodeMixer_Setup_beta\audio_filter\libscaletempo_plugin.dll,#1
  2⤵
  PID:2260