67c7cffe7c07e21d7ca8100d81778a8e0ea073a6e947a6781687f498ae740648

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:16

Target

r128gain-0.9.7-2/r128gain-tools/swresample-0.dll
Size

29KB
MD5

189c506db1993e7503bb9798a289cda2
SHA1

b8a8e05b37d7b52aef8e10c090c05bfc923efa45
SHA256

0e6586795ba258d98fb55a9df1b003b0719b1fc642b2479a1aa45e87eaec1024
SHA512

36f3d7f45d83aa8cf4f9d168432fc6b009720177bbcfd71bbc582ec81c02b37c5717bb3c87b630e98fc9e265cfd896909961f1598fd65747c48d2326428884dd
SSDEEP

768:eXJilD0Io1wrY5kayFEfXKrnnhjeJpiaxL79QxhjPvTLj3KVvYOECxw:GJilDuv/OnhjeJpiaxL79InHjgvYg2

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2984	2968	rundll32.exe	15
PID 2968 wrote to memory of 2984	2968	rundll32.exe	15
PID 2968 wrote to memory of 2984	2968	rundll32.exe	15
PID 2968 wrote to memory of 2984	2968	rundll32.exe	15
PID 2968 wrote to memory of 2984	2968	rundll32.exe	15
PID 2968 wrote to memory of 2984	2968	rundll32.exe	15
PID 2968 wrote to memory of 2984	2968	rundll32.exe	15

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\swresample-0.dll,#1
1⤵
PID:2984

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\swresample-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968