9c3dd40b4539a812baabc3b8e1cec9ae45a39ec8d799c1bd6e53d9d64a2366f0

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 11:55

Target

$_27_/Auburn Sounds Graillon 2.dll
Size

2.4MB
MD5

9b6953c41811355a418269e4fcf3ee4d
SHA1

629e470a051ebf84b53eb0819238f8e2c60a2929
SHA256

33bb3fabe7c08cd9ebf5f5aded545720bc9628aee89debbbf676e38af8f20818
SHA512

129f4a25109b1311ee90e963c3d9d11cc5fd9d414d1e5989cac2f826c4b0b3273239b8690259f6ba55a568ef38f4424c898f4f37fa80702917773f5a2e77eb5b
SSDEEP

24576:nKzMoNy9b5HRrd+3xZEVrL3HxOYOYPqfxpluPTW0Gxk/q8PeWHqbP7VqzAbqsOGj:nK3Yb/yEexU3hBHqbDVq7V0Y/UP+LNjQ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2792 2264 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2792	2264	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1364 wrote to memory of 2264	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 2264	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 2264	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 2264	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 2264	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 2264	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 2264	1364	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 2792	2264	rundll32.exe	WerFault.exe
PID 2264 wrote to memory of 2792	2264	rundll32.exe	WerFault.exe
PID 2264 wrote to memory of 2792	2264	rundll32.exe	WerFault.exe
PID 2264 wrote to memory of 2792	2264	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$_27_\Auburn Sounds Graillon 2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$_27_\Auburn Sounds Graillon 2.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 228
3⤵
- Program crash
PID:2792