c0c017f18b0afe8d9fd84617fb87153ac2ffd01f93db2e9b13144f3e242277da

Analysis

max time kernel
142s
max time network
32s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 03:45

Target
Auto-Tune_Access.dll
Size 70.2MB
Sample240601-ea5teagg6w
SHA256 97bd6cc14baf099ee528baaea15fe3a87fdbff85b601e97cfe3de3ffba52e8d7
MD5 22b8c8e507e501d5ed7747626c69e393
SHA1 a8015be4ff1c7bb62b61ada4051dbeb7841ff58b
SHA512 2ea51b373262d6c2c7af2ef6905a2cce2152fc42eb3e39846062b37eba04e205e4d1baa7c92f64fb7d041f0d268035f4ed866b6bff24a6719ddceb9ebeb0c951
SSDEEP 1572864:gKrbUlTGTI7A0E4zukyi8LZpED1sjWfz99ngOvG6:/L6ACzOUJsj2PnVG6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2100	1188	rundll32.exe	28
PID 1188 wrote to memory of 2100	1188	rundll32.exe	28
PID 1188 wrote to memory of 2100	1188	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Auto-Tune_Access.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1188 -s 196
  2⤵
  PID:2100

memory/1188-0-0x0000000180000000-0x000000018464B000-memory.dmp

Download