2794d6210acbc3a694dde7079d4badf9df39565118aa6a50478d3fe886dea723

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 00:40

Target
Plugins/FX/reacontrolmidi.dll
Size 376KB
Sample240512-a1a99sbb28
SHA256 2aa5d88bd4db203853fdf92b1427a2625b77b98ecc0011307022632a017281ca
MD5 71ccb25a9d1dd6cd0f19d82e2fbec098
SHA1 00d46f72b021c5be7458aca4e8bef18a97f19176
SHA512 f11de591fb30090252489ed0655661b801ddf49cbc33b28431d1d0cc5b5b0cebb1281b273282d44c90d8d5493b4bc41be0d137a034a98e20bf0b0f35ceb3a476
SSDEEP 6144:KMWLcV3CJo3vYvGQ4t1GErNwoQ4lKN1GJpq8Rhkz80BAWd5LSEFh7zBZOsJVg45H:sgVy29Sod+Ih1of+EzBDJT5/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2332	2380	rundll32.exe	28
PID 2380 wrote to memory of 2332	2380	rundll32.exe	28
PID 2380 wrote to memory of 2332	2380	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reacontrolmidi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2380 -s 168
  2⤵
  PID:2332