fd458a3b3bd8eb56e2af627e877e11b8fb9d0d4a731e262ea0ce44f0b9586de6

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 04:08

Target
Data/SoundTouch.dll
Size 749KB
Sample240605-eql18sdg3z
SHA256 628cd66e83ce643ed7fc9ee6f54da30a9f95121e9fe93d17db3339627446fa46
MD5 0c434c45b03d0dc7e64ab1e3fcf8c59c
SHA1 0e13064565d04ca2e4e2c594c553e97021f6ffae
SHA512 cf3cabbd5da1b9fef0d909cd09c7cc1c41b9433a7cc727401a7c1b1109b8abbce7c5fdae8423f3bbce4322ddff1facf049a1a6620c65f484eb1cbdc05c76cc61
SSDEEP 12288:/da1ETMo4FN/HrF9FAwxK6joDmKh/avOPmy6uZasqFhQdBTu0tSED1L0CgJ4Acjb:U04/rF9FAwxK6cDmKVamPmdsqFhQdBTl
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28
PID 2416 wrote to memory of 2436	2416	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\SoundTouch.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\SoundTouch.dll,#1
  2⤵
  PID:2436