af8155a3e844a02b36d69bbcf4922e845d0d3eb9dd11c6fd0f777d94d13a7d30

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 10:37

Target
FFModules/RMCodecs/tools/rnaudiocodec.dll
Size 72KB
Sample240612-mn9zaavepr
SHA256 dc30b1886c5cdabb6d9fcd3a196738e505bd8eacdbe8860964ff9f731b28a958
MD5 3347f019be533bf341e5083e121b6b5e
SHA1 a81ce388ec9923b6517ee8b13f3b702ea312322f
SHA512 432e1ec3f658e1892d0d43c5d17490002c266b92a7f3ce5797b77dc12996536e223b1d43e53b2a2270772ffaf2268947c54084d3815bb4ac9455bd3e2864ae7f
SSDEEP 1536:B/JpLC//4ruybdIm6jo6fzoFlztKugTq5/:B/Jpj/B6fkFlztUTq5/
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28
PID 1620 wrote to memory of 2132	1620	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\rnaudiocodec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\FFModules\RMCodecs\tools\rnaudiocodec.dll,#1
  2⤵
  PID:2132