28ac79ffdd5e6123e102acd5b4c6130b29d419b247548413cf6fc87549f4b025

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 12:18

Target

Framework-R2R/Acustica/Framework/NeAsBr01e9.dll
Size

16KB
MD5

9246f339766640b9ab479efa4e702cc8
SHA1

8e95706dd9a5bc80b79e28a864c7874fe0d230f8
SHA256

e0e09b7059719034ccdebd0ecc11846d9051c17fccabddcf8d37431c78eb6cd4
SHA512

2ee71b27892ad269aa1eb7a3d9864f4ad68303003217235e5e5463bdb56b28f1f3a1daede38cfe907cf15dd14a5627f04ecec3ca73caa55431554d7d3feddc81
SSDEEP

192:TNQ+0MhppxDMSlTFTSu5sxSaFjVDbdHj9WykpIs2JJKGGBQJqVMw:x2GvxDjFmu5sZHBpgutnKnw3w

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1676	2340	rundll32.exe	28
PID 2340 wrote to memory of 1676	2340	rundll32.exe	28
PID 2340 wrote to memory of 1676	2340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Framework-R2R\Acustica\Framework\NeAsBr01e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2340 -s 84
  2⤵
  PID:1676