3e4c0d38b5e8673c740917bc444ea154bbcfd99e2c424f3e1a8760a00ddc1589

Analysis

max time kernel
100s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 18:56

Target

FMODGMS.dll
Size

180KB
MD5

be68f44a1b532da3ec52ca1ba4c6d7d4
SHA1

214e6c4ed11b10db523718e2f1fbf16ad7a24de3
SHA256

9d1de6c1e9262048eb4c417ed9fe497cc7548ede802475f079345c0f7cd9335c
SHA512

e94a2eb628c1bd3f7bae2c311c3b74c4cb159cf16ce2d45bfeea9fb8233b31711fbdd3d51ff9b5cd5e2e9fd0877faa349481afd8817a50b800ce7ce26b65a859
SSDEEP

3072:NAucEC4pE4a8bsP/f3A/0n72LRGkYu9biUXI/yfnGsAg0FuXVrt73VBDrSYg:KucECtq0n34kCLQkYEmRPsAOFrJlprSF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4964	3204	rundll32.exe	91
PID 3204 wrote to memory of 4964	3204	rundll32.exe	91
PID 3204 wrote to memory of 4964	3204	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FMODGMS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FMODGMS.dll,#1
  2⤵
  PID:4964