a490e2d404c0a5a566b63994d94b5bcc29388c8304be35dca6e473327b74ea46

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 14:12

Target

YQL_Lyrics_Common.dll
Size

505KB
MD5

72dbbf502f310b3820ff4589cf4e9ae7
SHA1

710871a5957a7e3932b7ef2a8990cc133afa8058
SHA256

4549c30b9bf613d757e139b8f0f55294b04b6297aa358ef85dbe71bd6b4235c8
SHA512

a9ebc84313ec4dd876c2f6b274297c4d2d244a5dfcfa05f6b2d23145107c39278e7679c0eb230463f72e2da817ed8b62b3b6b4621da3e0ef13e438c4726b689d
SSDEEP

6144:SH3PvjePZck+afKQpn0qYUwhpRfh2pT41VrRBE1JOsgXf08/OlA:S3SPlPFd0qYVplheT8rnE1/W/r

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2036 wrote to memory of 1992	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1992	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1992	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1992	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1992	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1992	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1992	2036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YQL_Lyrics_Common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YQL_Lyrics_Common.dll,#1
2⤵
PID:1992