67c7cffe7c07e21d7ca8100d81778a8e0ea073a6e947a6781687f498ae740648

Analysis

max time kernel
236s
max time network
253s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 12:16

Target

r128gain-0.9.7-2/r128gain-tools/libreplaygain.dll
Size

15KB
MD5

38d7eb7aa75381fad00d23abbd9d95f3
SHA1

c378f2adb602560f61d98e24e10a2e8bd5bcfce4
SHA256

d53768d9c441d416c66c65364ed686f577f5f5e97c1f7663a8c83f73e6da2183
SHA512

71c06b08acb91fba140398d0a8e718aa85027204400df7b0fc8009a4e1a7033cc9862143bf667af9ff22a59f84b266dc73299a96a68f06444cecc4b0f81b7bff
SSDEEP

384:AwB84CCLIpomEXRrVI6rumZgq39CI6rjC55VMk4jm1Gr:AwBfzLIpoRXRrO6rxZgq39ChC55VMJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4220	4564	rundll32.exe	90
PID 4564 wrote to memory of 4220	4564	rundll32.exe	90
PID 4564 wrote to memory of 4220	4564	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\libreplaygain.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\libreplaygain.dll,#1
  2⤵
  PID:4220