8398f9158dd22bfb3d847b38495a2720a73d83df4dc8c332837c97282cf56b98

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 16:42

Target

scripts/zAmbientAudio.dll
Size

5KB
MD5

3fab24b898e6ea724952572b2cf38044
SHA1

da782a56455bf7d148b59c1726d3abaaf380926b
SHA256

fa0f56adfa480ee2fc1698c63f9239319e88db949b338111055057c414da5159
SHA512

a1a9abc79a6fcaacfe0857a12173fc3fda76c7c6775be05833e1febb66586537e1263ee59eed0b23c6aa96284f3ff5c25c556f6df119fc79f5c3a5496692ac9e
SSDEEP

48:ytFcgYB2U1H70W68MCJ6fKqchQJoSZYYIQqD1CADw6BvX5r7Wiu3oacOIlQEagLh:SZI2gYbCJo5wQJoNYGxW6BBWIi9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 4576	364	rundll32.exe	85
PID 364 wrote to memory of 4576	364	rundll32.exe	85
PID 364 wrote to memory of 4576	364	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\zAmbientAudio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\scripts\zAmbientAudio.dll,#1
  2⤵
  PID:4576