6ec79179c1e61df21e38b754017b672d559f0537ce0a3b64afe7df97025fd01d

Analysis

max time kernel
1561s
max time network
1568s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10-10-2023 10:38

Target

rousrDissonance.dll
Size

319KB
MD5

49069a0ab0892d2a4b1f5ff114571b5c
SHA1

f75c3ef3b3da8fe182307ebf650bf0aa05678429
SHA256

02224a4afa548de7b409d515dc4e9e7c5a60653f432639c568140a05cf84f045
SHA512

557f6e2fff9b11bbf5e3508fbd871b8d4d14a619e11b17738c414903412ec80d6b7f74f80a3d80cbff7956fbe0f83453f03d49edb1550d35a6754638a33c5cb1
SSDEEP

6144:nf5qHW95s2TtMMAvqaBPsku69/Y16iBRe1KLJ2r1Y0bw5aU0eTVza5q/+uPGhIJC:jMMAvqaBPst6e16XULy1Y0Dela5qzO2Q

Score

1^/10

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\discord-\DefaultIcon	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\discord-\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\discord-\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\discord-\shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\discord-\shell\open\command\ = "C:\\Windows\\SysWOW64\\rundll32.exe"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\discord-	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\discord-\ = "URL:Run game protocol"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\discord-\URL Protocol	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\discord-\DefaultIcon\ = "C:\\Windows\\SysWOW64\\rundll32.exe"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 1488	1384	rundll32.exe	28
PID 1384 wrote to memory of 1488	1384	rundll32.exe	28
PID 1384 wrote to memory of 1488	1384	rundll32.exe	28
PID 1384 wrote to memory of 1488	1384	rundll32.exe	28
PID 1384 wrote to memory of 1488	1384	rundll32.exe	28
PID 1384 wrote to memory of 1488	1384	rundll32.exe	28
PID 1384 wrote to memory of 1488	1384	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rousrDissonance.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rousrDissonance.dll,#1
  2⤵
  - Modifies registry class
  PID:1488