b219c036534453233322a674113c575f3bb374b2f3114012c72d4b5b5dcd8d9a

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:31

Target

sox-14.4.2/libpng16-16.dll
Size

206KB
MD5

d1e30ccfc7765882364c47b770a06ac6
SHA1

52f566222a728e521c875e2e2fc40cb4acc753dd
SHA256

22d46adb7927690eeeb1a27f9544108f7a1c66bf1daec90f3c41aa36e176920d
SHA512

a330887b5fb55afca78ded90ffd9b438e81054f68787be3e1be9b0d778da3fdffe8b1902bd92316229e1fd25c83f30d74af9677eb0a0f9a39779d0c162c9ac6e
SSDEEP

3072:0505q6hoAllEoZY/eViXivi5UmwJT+WSeuAgN6UwLXUSmPNU:5srAlKWY2V4ivdmCT+ze7CeLXQO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2092	3004	rundll32.exe	27
PID 3004 wrote to memory of 2092	3004	rundll32.exe	27
PID 3004 wrote to memory of 2092	3004	rundll32.exe	27
PID 3004 wrote to memory of 2092	3004	rundll32.exe	27
PID 3004 wrote to memory of 2092	3004	rundll32.exe	27
PID 3004 wrote to memory of 2092	3004	rundll32.exe	27
PID 3004 wrote to memory of 2092	3004	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sox-14.4.2\libpng16-16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sox-14.4.2\libpng16-16.dll,#1
  2⤵
  PID:2092