fd458a3b3bd8eb56e2af627e877e11b8fb9d0d4a731e262ea0ce44f0b9586de6

Analysis

max time kernel
139s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 04:08

Target
Data/SoundTouch.dll
Size 749KB
Sample240605-eql18sdg3z
SHA256 628cd66e83ce643ed7fc9ee6f54da30a9f95121e9fe93d17db3339627446fa46
MD5 0c434c45b03d0dc7e64ab1e3fcf8c59c
SHA1 0e13064565d04ca2e4e2c594c553e97021f6ffae
SHA512 cf3cabbd5da1b9fef0d909cd09c7cc1c41b9433a7cc727401a7c1b1109b8abbce7c5fdae8423f3bbce4322ddff1facf049a1a6620c65f484eb1cbdc05c76cc61
SSDEEP 12288:/da1ETMo4FN/HrF9FAwxK6joDmKh/avOPmy6uZasqFhQdBTu0tSED1L0CgJ4Acjb:U04/rF9FAwxK6cDmKVamPmdsqFhQdBTl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1384	2572	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 2572	3160	rundll32.exe	88
PID 3160 wrote to memory of 2572	3160	rundll32.exe	88
PID 3160 wrote to memory of 2572	3160	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\SoundTouch.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\SoundTouch.dll,#1
  2⤵
  PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 604
    3⤵
    - Program crash
    PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2572 -ip 2572
1⤵
PID:3492

memory/2572-0-0x0000000063A80000-0x0000000063B43000-memory.dmp

Download