67c7cffe7c07e21d7ca8100d81778a8e0ea073a6e947a6781687f498ae740648

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:16

Target

r128gain-0.9.7-2/r128gain-tools/libsetdlgitemurl.dll
Size

11KB
MD5

e5494e2293ced85bbb4c901ca638a279
SHA1

4c851eec59d5aa164beaf07a0483fea944cf5206
SHA256

022b0bfcb5e1d2eb9d2b2abdb4ccba1f2f1f32732a58b38d313f4bd145fe990e
SHA512

b5f7e48086e176eb86172d337443ea7fd1ea455df1484df1fd73fff9df6f33c357348af8545a4f7b0fe31e7435d87c1383d482b68bf90e48a7ca99189adbfe08
SSDEEP

192:Ipw3v4UGCoz1tvKmW7C4KNoCXEU+b9HZrkRvGa6pr:pv4UCzq57C4KecZ+Hrkk

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2032	1364	rundll32.exe	16
PID 1364 wrote to memory of 2032	1364	rundll32.exe	16
PID 1364 wrote to memory of 2032	1364	rundll32.exe	16
PID 1364 wrote to memory of 2032	1364	rundll32.exe	16
PID 1364 wrote to memory of 2032	1364	rundll32.exe	16
PID 1364 wrote to memory of 2032	1364	rundll32.exe	16
PID 1364 wrote to memory of 2032	1364	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\libsetdlgitemurl.dll,#1
1⤵
PID:2032

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\libsetdlgitemurl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364