453c1a8db997f6bfba6082ff441d2b78c355f2a3bdd4dcbd5e2f16bba0c3f4ad

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 07:53

Target

Plugin/extra/AudioHLE_4th_Tick.dll
Size

68KB
MD5

1ff92aa897a509432d17d4ccf991535e
SHA1

59b09a223ed564b0a154b81b328f92e8e7d51ba2
SHA256

da385f5bdbe45cf43c257e2124f5a9c70c899aa904ba7f1fad4aa56d3e946a6e
SHA512

35ea593b120f44459475ed9f3c891ce033bd1ec1b488b4d61e7340b9093742209848f187c459ca44efe908a740b79a3bae892ecfc6847253e055d4ddb5847c4c
SSDEEP

768:Ed5GyE3g4t5BLj7QcUIEyq8IprZBCHURkhaft3k36JKUkkfK1pkuQ:GEPpDgtK4Vk36Jk1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2332	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2332	2368	rundll32.exe	28
PID 2368 wrote to memory of 2332	2368	rundll32.exe	28
PID 2368 wrote to memory of 2332	2368	rundll32.exe	28
PID 2368 wrote to memory of 2332	2368	rundll32.exe	28
PID 2368 wrote to memory of 2332	2368	rundll32.exe	28
PID 2368 wrote to memory of 2332	2368	rundll32.exe	28
PID 2368 wrote to memory of 2332	2368	rundll32.exe	28
PID 2332 wrote to memory of 2196	2332	rundll32.exe	29
PID 2332 wrote to memory of 2196	2332	rundll32.exe	29
PID 2332 wrote to memory of 2196	2332	rundll32.exe	29
PID 2332 wrote to memory of 2196	2332	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\extra\AudioHLE_4th_Tick.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\extra\AudioHLE_4th_Tick.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 264
    3⤵
    - Program crash
    PID:2196