8c8a1a0afaa57227b2aaeb8d58a458e091695eac98ff257e4b2a993db17375ae

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2023, 16:22

Target

RodeMixer_Setup_beta/audio_mixer/libfloat_mixer_plugin.dll
Size

27KB
MD5

907c7b9662ed57cb17980c9bddc3ab11
SHA1

441627fd9edc27c72cc4a298f7846f40d3d3f90c
SHA256

34f59bc5d6c64721d6c4bb0b4bc53c414659c13b36cecf98ff90249d4d29cceb
SHA512

0abcc146c00904cf2ec11f2d3b7df2ca7e086b9fb2e4bd86505da9ab0225bbdb1905edb0ab851b734f28e14824e7c4bae5a8ac3a5040682e0d400774b40cf242
SSDEEP

384:oJeO0Xaz5LVCFpJoFmghthKZsHL0MhehKZsHLcj/hn2S:eeXKzJVC5tghPu8hn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4304	4760	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4760	3696	rundll32.exe	79
PID 3696 wrote to memory of 4760	3696	rundll32.exe	79
PID 3696 wrote to memory of 4760	3696	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RodeMixer_Setup_beta\audio_mixer\libfloat_mixer_plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RodeMixer_Setup_beta\audio_mixer\libfloat_mixer_plugin.dll,#1
  2⤵
  PID:4760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 600
    3⤵
    - Program crash
    PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4760 -ip 4760
1⤵
PID:3520

memory/4760-0-0x0000000074B10000-0x0000000074B1C000-memory.dmp

Filesize
48KB

Download