67c7cffe7c07e21d7ca8100d81778a8e0ea073a6e947a6781687f498ae740648

Analysis

max time kernel
165s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 12:16

Target

r128gain-0.9.7-2/r128gain-tools/libsox.dll
Size

2.5MB
MD5

8c6858f0527771d3cc560518e1c81bc1
SHA1

112e3f48cd872cbc5842baeb4a2bb0869ed12a8f
SHA256

e6632ebf34a977a578d4078c19ce398761ae2b1890e2d0cbf487adfb28233206
SHA512

68725832885e72db5d8ab90d7e9ded3daf5c6c4dbeff2beb6fb78f35b3e2168c3cca4d46469d73b5f3116dc165314b7ec966b58f3ceb414c8982f9e93a5177f7
SSDEEP

24576:t8mT7ogoP0C25VZ0Q+oz5k5JzcUNGnuiW83FRW7xpXNzcYJ:GgVO9o9kfwUUnuPaFwNpXC0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1876	2860	rundll32.exe	20
PID 2860 wrote to memory of 1876	2860	rundll32.exe	20
PID 2860 wrote to memory of 1876	2860	rundll32.exe	20

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\libsox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\libsox.dll,#1
  2⤵
  PID:1876

memory/1876-0-0x0000000070DC0000-0x000000007103B000-memory.dmp

Filesize
2.5MB

Download