5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 16:14

Target

Plugins/Win7AudioPlugin.dll
Size

141KB
MD5

b06e6c4e350a4315d876abeae9a9a6d1
SHA1

262a43e685ab3b1c5430044b76b7b1f19d5a46e5
SHA256

68606d6353e8bcb6a4c28255ab97cf79668ae38662585ebee07193b2f3b693ae
SHA512

34c1e357347b119ff4cc58679c5b5c9bdb8b3ba82382dbe99471173ae535ad272913a75a43c698947bdcb137357d904a3ac6618f853c039d0b04d566d1e79234
SSDEEP

3072:ACe9E4fS6JzkdujhaJi4MtLJTWcnBsO2ka7asMm7p9Wo5LBV4CIivI:AXJfeKEWo7pYo1BCWvI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3588	1492	rundll32.exe	82
PID 1492 wrote to memory of 3588	1492	rundll32.exe	82
PID 1492 wrote to memory of 3588	1492	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Win7AudioPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Win7AudioPlugin.dll,#1
  2⤵
  PID:3588