c0c017f18b0afe8d9fd84617fb87153ac2ffd01f93db2e9b13144f3e242277da

Analysis

max time kernel
23s
max time network
24s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 03:45

Target
Auburn Sounds Graillon 2-64.dll
Size 2.4MB
Sample240601-ea5teagg6w
SHA256 025f1faccab94a231131f30cdb2db9159312cae8e38bb96ebe990c7a83690412
MD5 4af0dab20206e9c6580047e01aa1957a
SHA1 5543da76922b57bfc76118f382a8efd820eb91ac
SHA512 3dd53e1df4ef18b34beb94b34f20b23048e6fc0d47bd108a025f4075faa92d082bb32beda0793344bb7a5cd8945df7037beb5490a7f21cc235860935701367d7
SSDEEP 49152:/EHoos55W2my9vXi5EdU9oV0Y/UnmJuFbDVqL+/TI:Ho5rH9CsWuFbZqa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2808	2472	rundll32.exe	28
PID 2472 wrote to memory of 2808	2472	rundll32.exe	28
PID 2472 wrote to memory of 2808	2472	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Auburn Sounds Graillon 2-64.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2472 -s 124
  2⤵
  PID:2808