9c3dd40b4539a812baabc3b8e1cec9ae45a39ec8d799c1bd6e53d9d64a2366f0

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:55

Target

$PROGRAMFILES/Common Files/VST3/Auburn Sounds Graillon 2.dll
Size

2.4MB
MD5

7516514ab90f60a60eba7be2d657314e
SHA1

cee2add663154c929db160c0b16af7aac15c999b
SHA256

fd68d2ec8126c19d94a93cced22b11c902653a6eca9fdccc2a51fec51546896b
SHA512

667f7ba40b4c3dace058f17fea9b4bc95ad17be403767a9872e059bfeeef4c78111504086f60cb354c6b4eb7da8afcf52e4c52444bcd23b472d98a13da95e061
SSDEEP

49152:qT4L9oBX/QcHbTIR7bDVq7V0Y/UC+/GkTrffugjY:qT4+X/QcHbTIR7bZqxs7Dc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4704 wrote to memory of 3208	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 3208	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 3208	4704	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Common Files\VST3\Auburn Sounds Graillon 2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4704

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Common Files\VST3\Auburn Sounds Graillon 2.dll",#1
2⤵
PID:3208