67c7cffe7c07e21d7ca8100d81778a8e0ea073a6e947a6781687f498ae740648

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 12:16

Target

r128gain-0.9.7-2/r128gain-tools/avutil-51.dll
Size

132KB
MD5

210707f8739c439272f5aa4a96af6ccb
SHA1

91551503a47df096630051e63898770ccc967d49
SHA256

e0962c1037e914a03514a3542605aa58abfc36701de700708f0d4d129181fd7f
SHA512

12987f62296bfef89c04a80db7e012a1972730fe2a1e1610ff48a30e7d5769799f4fa039561146efb13811bf500683dc9279aae0650291071d7728e52e15dccd
SSDEEP

3072:p7vrHLdL10iZNGghyxK3WY8/c28sMNd4jHRvFPK81WdPV+Yrs:drHLdLjPhyYmY8/DZMfsxM7dPVtrs

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1912	1888	rundll32.exe	16
PID 1888 wrote to memory of 1912	1888	rundll32.exe	16
PID 1888 wrote to memory of 1912	1888	rundll32.exe	16
PID 1888 wrote to memory of 1912	1888	rundll32.exe	16
PID 1888 wrote to memory of 1912	1888	rundll32.exe	16
PID 1888 wrote to memory of 1912	1888	rundll32.exe	16
PID 1888 wrote to memory of 1912	1888	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\avutil-51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\r128gain-0.9.7-2\r128gain-tools\avutil-51.dll,#1
  2⤵
  PID:1912