a13fad0d43b3db3b1f78118c3591a42cca0ed4373414ed82f2351719b2901b92

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 06:00

Target

Triworks/乐音 3.0 (Demo)/LFCMP11n.dll
Size

267KB
MD5

950e34edd3bbd86f4be9729266d11a6c
SHA1

0f2a79d1c75cf12f6a441700e393a3fe50d6eae8
SHA256

e38eafdd23f84bb09d71c8217d0755191120601650637510da30040418ce18d6
SHA512

d3f556069f69b4772686547f44b3563b27b114f49617654d8b274e16068527b31ce76da28ef725594a756598f75546f380f70d3673d536dd4774e7d6e0b562a5
SSDEEP

6144:ehN0pQpxgijhNdbqwJrx9f+8kPxuMXQj5dCQUbPp/x1p+8eyyjhXkxTcNtRgT78Z:eH0pQpxgijhNdbqwJrblMXQ9dCTPp882

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3872 wrote to memory of 1628	3872	rundll32.exe	rundll32.exe
PID 3872 wrote to memory of 1628	3872	rundll32.exe	rundll32.exe
PID 3872 wrote to memory of 1628	3872	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Triworks\乐音 3.0 (Demo)\LFCMP11n.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Triworks\乐音 3.0 (Demo)\LFCMP11n.dll",#1
  2⤵
  PID:1628