67c7cffe7c07e21d7ca8100d81778a8e0ea073a6e947a6781687f498ae740648

Analysis

max time kernel
162s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:16

Target

r128gain-0.9.7-2/r128gain-tools/postproc-52.dll
Size

156KB
MD5

8602570d59421a5f660d76c69647c45a
SHA1

69aa181bf508965135ac8ac75a45ecceb80541e3
SHA256

1ff1780661b4ff5ccb3386ac55542d87892ae5dbf3479738c2f06e26c0337c02
SHA512

502f4b9d56a0dc9c49fd7c578e2b1c584b2dce478438f3fc446f335013731fdb09775880cb4a002e71d893e8535b27e021281892bb3a761223bfa8c1390e242a
SSDEEP

3072:2xxxxRxRw6KJ2YQwuaa6aa66Qea6zzWZZhLBG0/OMGtlBbY+6i3ISEWDmSUhXTtw:2xxxxRxRw6KJ28uaa6aa66Xa6zzY/BGL

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 5028	4936	rundll32.exe	88
PID 4936 wrote to memory of 5028	4936	rundll32.exe	88
PID 4936 wrote to memory of 5028	4936	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\postproc-52.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\postproc-52.dll,#1
  2⤵
  PID:5028