a13fad0d43b3db3b1f78118c3591a42cca0ed4373414ed82f2351719b2901b92

Analysis

max time kernel
135s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 06:00

Target

Triworks/乐音 3.0 (Demo)/ltefx11n.dll
Size

221KB
MD5

28f1934585c9ac6010c5413c8e78c66e
SHA1

0972fae01be756fa25bab171f9db2d61ba055c98
SHA256

6a8420301a7290328c14df95e0c9840530b71de7f0337d215844524608bf5673
SHA512

dce568ba6fcccf8cf09cdb70cfcaa34ce50394af50f5391d093c9853211ed9b2a733e10733d324fdffec4bd18060e732faa5149845a7fa816b64836383ee53ab
SSDEEP

3072:i5yLGAZJtoB/pyAsr9O2cnVApz01EJGMMM0Q/FcZgtj3KgpT1:iapoBnsgVApJJBMMHqs1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5060 wrote to memory of 5040	5060	rundll32.exe	rundll32.exe
PID 5060 wrote to memory of 5040	5060	rundll32.exe	rundll32.exe
PID 5060 wrote to memory of 5040	5060	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Triworks\乐音 3.0 (Demo)\ltefx11n.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Triworks\乐音 3.0 (Demo)\ltefx11n.dll",#1
  2⤵
  PID:5040