7de68704bad0f0ecc0a815428043c3eed923d5e93c02df4ee593cf95db334705

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 15:52

Target

EOPAudioRecorder/RecordAudio.dll
Size

234KB
MD5

48468b252c2fdc9f112693e57084f85c
SHA1

89807e70d6c852db4806f6b1e037bc0403996dfb
SHA256

547d814ff4d3838c01eed83acc1cf5220cefaa9a3e1acbdde67ec43ee1890522
SHA512

08e9a90b2f214d2b2ec4d14867680d2153679bd8038d190b8a3c788d3bee652565cd4cc5eb0dc4f908288cdd5da834bb4541e5dec574c719ab8b7113fef208be
SSDEEP

6144:AUa7rNXASqpparRA+Gh1Uj1dhAQBqZiiEL:AXAnAGh1Uj1dhAQBqZg

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2820	1816	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1816	2816	rundll32.exe	28
PID 2816 wrote to memory of 1816	2816	rundll32.exe	28
PID 2816 wrote to memory of 1816	2816	rundll32.exe	28
PID 2816 wrote to memory of 1816	2816	rundll32.exe	28
PID 2816 wrote to memory of 1816	2816	rundll32.exe	28
PID 2816 wrote to memory of 1816	2816	rundll32.exe	28
PID 2816 wrote to memory of 1816	2816	rundll32.exe	28
PID 1816 wrote to memory of 2820	1816	rundll32.exe	29
PID 1816 wrote to memory of 2820	1816	rundll32.exe	29
PID 1816 wrote to memory of 2820	1816	rundll32.exe	29
PID 1816 wrote to memory of 2820	1816	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EOPAudioRecorder\RecordAudio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EOPAudioRecorder\RecordAudio.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 236
    3⤵
    - Program crash
    PID:2820