9c3dd40b4539a812baabc3b8e1cec9ae45a39ec8d799c1bd6e53d9d64a2366f0

Resubmissions

07/07/2024, 20:29

07/07/2024, 20:21

20/04/2024, 11:56

max time kernel
138s
max time network
149s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20/04/2024, 11:56

Target

$_27_/Auburn Sounds Graillon 2.dll
Size

2.4MB
MD5

9b6953c41811355a418269e4fcf3ee4d
SHA1

629e470a051ebf84b53eb0819238f8e2c60a2929
SHA256

33bb3fabe7c08cd9ebf5f5aded545720bc9628aee89debbbf676e38af8f20818
SHA512

129f4a25109b1311ee90e963c3d9d11cc5fd9d414d1e5989cac2f826c4b0b3273239b8690259f6ba55a568ef38f4424c898f4f37fa80702917773f5a2e77eb5b
SSDEEP

24576:nKzMoNy9b5HRrd+3xZEVrL3HxOYOYPqfxpluPTW0Gxk/q8PeWHqbP7VqzAbqsOGj:nK3Yb/yEexU3hBHqbDVq7V0Y/UP+LNjQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	4912	WerFault.exe	72

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 4912	3648	rundll32.exe	72
PID 3648 wrote to memory of 4912	3648	rundll32.exe	72
PID 3648 wrote to memory of 4912	3648	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$_27_\Auburn Sounds Graillon 2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$_27_\Auburn Sounds Graillon 2.dll",#1
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 640
    3⤵
    - Program crash
    PID:1272