8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 16:42

Target

scripts/wDSound.dll
Size

52KB
MD5

57284324df4d261aaa9f75754c55b476
SHA1

0f13ccd5e82992e4cf03c886255e11ac2a58cd98
SHA256

f3f119285a2256a94809308902353837ebecbb1e80156506d47df2d679a43b76
SHA512

4094fc5e7d2cb029f5e480758329f3d70063f6eed00d26abffcad3afbba972b97e5f76c3edf106e6abadbe2a9a2c017e015ba672daab05cded3fb9117ccaae59
SSDEEP

768:2yl95+2LT9xgycIHhynyKZnT61Ncbdwllw28ZG0Ut1H+BMWMmqgSq:Fr5xxgycIHQyK9TkNcZwll4HUt1jmHS

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1436	2220	rundll32.exe	28
PID 2220 wrote to memory of 1436	2220	rundll32.exe	28
PID 2220 wrote to memory of 1436	2220	rundll32.exe	28
PID 2220 wrote to memory of 1436	2220	rundll32.exe	28
PID 2220 wrote to memory of 1436	2220	rundll32.exe	28
PID 2220 wrote to memory of 1436	2220	rundll32.exe	28
PID 2220 wrote to memory of 1436	2220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\wDSound.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\wDSound.dll,#1
  2⤵
  PID:1436