d30e33e5f4ec42d96e1641697f3141fcd7f1f8fe8db9301fc72b540ba789f082

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 00:50

Target

Voicemod V2.48/libtools.x64.dll
Size

3.5MB
MD5

e83bafa12d7af874dc101fd14a390a13
SHA1

b1fa094e67518e9447e056b637bd8d2d9a49a516
SHA256

a096845bb688decfa1f4e4d2dbff19d91ba27904ab2c837d92f802ed0601d1d2
SHA512

364f21e88060cd13132c3ee48368f921d6dab5f8c95c50d67ba0817d2661b6999ec2c88a2fa8a4688c4fe4fb3eae53d62a9116006815f301dc7a17743e7879cd
SSDEEP

49152:6xGx9nfXkEOvg4PuD1sZzJnvSomQ0yFB0e9pg3kPLA7j0TcAKHlN:CGDm5HeDkDOZAKFN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2972 wrote to memory of 2900	2972	rundll32.exe	WerFault.exe
PID 2972 wrote to memory of 2900	2972	rundll32.exe	WerFault.exe
PID 2972 wrote to memory of 2900	2972	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Voicemod V2.48\libtools.x64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2972 -s 172
2⤵
PID:2900