09643633731242877000c5de3c2a33ee66f36056005fe7e307a996bdef1d0de3

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 17:06

Target

HCNetSDKCom/OpenAL32.dll
Size

417KB
MD5

52c83a72943b529b7f495b0606c117b6
SHA1

dcc74f5109a09c4cec8274f2968159c80016002d
SHA256

b21ae0059a8182a51d1645a44f403429e60e26453353c0d708d7f501557ca01c
SHA512

17179685e6e65c9130ccaea16c8953be818e4c6502595cb2e6dabebbc05f904e98b1797173e880ddfb64276cb0b53d48d8caae28457d1531160810af90eb6706
SSDEEP

6144:rXv1/ktv9QkVZN/Ju8sBfwvixrahNybEsl2ufvtgp2HlofevpQZjNAOs+D1Q3:rXv1Mok7N/mBfwMxbEsrHthLhQZjNVa

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2236 wrote to memory of 2468	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2468	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2468	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2468	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2468	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2468	2236	rundll32.exe	rundll32.exe
PID 2236 wrote to memory of 2468	2236	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\OpenAL32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HCNetSDKCom\OpenAL32.dll,#1
2⤵
PID:2468