e38025d820f932697f2d3429e7543d9089bfd129d144aeb50b0967aa7dd8a3fd

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 07:11

Target

Plugins/enc_vorbis.dll
Size

1.1MB
MD5

630c977507b7a76fec58f25766b4899d
SHA1

6d4289aa267aae049dd2a4ec9a9a351b049810a2
SHA256

398b182e915bcf0b22da23aaed3625a08fc825e605634931d7835e5e4cf6e1e6
SHA512

ec48df6e9629db9936ba7c4ad949953034ed200570d463291a381304c7af91409344ebd525c2d4ca1780e60b6e3f11d425d05ff501ee0d192f2b0d7f9428f325
SSDEEP

3072:V1iIPFW/5EBPnhfBU+GFRlopVz42qPyT1WZRaadOrAg0Fu4lEMR0I41U8zoexi1g:LiZRcPnhfBU+qwTqPygbaadOAOOR0bw

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2608	1908	rundll32.exe	28
PID 1908 wrote to memory of 2608	1908	rundll32.exe	28
PID 1908 wrote to memory of 2608	1908	rundll32.exe	28
PID 1908 wrote to memory of 2608	1908	rundll32.exe	28
PID 1908 wrote to memory of 2608	1908	rundll32.exe	28
PID 1908 wrote to memory of 2608	1908	rundll32.exe	28
PID 1908 wrote to memory of 2608	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\enc_vorbis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\enc_vorbis.dll,#1
  2⤵
  PID:2608