b219c036534453233322a674113c575f3bb374b2f3114012c72d4b5b5dcd8d9a

Analysis

max time kernel
122s
max time network
154s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 14:31

Target

sox-14.4.2/libsox-3.dll
Size

2.2MB
MD5

acdb7f5ecee425f091dd55bd90f2911c
SHA1

c6e51a936b699ee3c5c9fc966fd90041ddb88e46
SHA256

240a7e47a4274908786220f1b92372ed1b5f2a1c29874292fad5e64f120d84b4
SHA512

4ef00d74cffe0738041b1ebdb994fa05611c4a8e7cef7da2d8a5a1271d50e455e10cae00b76c4d53f55c06adfbe5330b584d4c1309aadb0d0c3b8b46503d0f17
SSDEEP

24576:OjWwy1Ms9E+L21vTrmH5KcxVp3paEs83/igAPmv39hb4tn/5OtAuJ9VXynZ1w:Oj3ynXmvTrqn7pds8KgAPmv9h2uFOZ1w

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2972	1616	rundll32.exe	29
PID 1616 wrote to memory of 2972	1616	rundll32.exe	29
PID 1616 wrote to memory of 2972	1616	rundll32.exe	29
PID 1616 wrote to memory of 2972	1616	rundll32.exe	29
PID 1616 wrote to memory of 2972	1616	rundll32.exe	29
PID 1616 wrote to memory of 2972	1616	rundll32.exe	29
PID 1616 wrote to memory of 2972	1616	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sox-14.4.2\libsox-3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sox-14.4.2\libsox-3.dll,#1
  2⤵
  PID:2972

memory/2972-0-0x0000000064080000-0x00000000640CB000-memory.dmp

Filesize
300KB

Download
memory/2972-1-0x0000000064080000-0x00000000640CB000-memory.dmp

Filesize
300KB

Download
memory/2972-2-0x0000000067D80000-0x0000000067F95000-memory.dmp

Filesize
2.1MB

Download