5497ea567644f9539497d11cc3e85eb507013d6260ec2d8aa2d914d80a586080

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 00:52

Target

RLuncher_1.5.0.3/Other/App/Edgar/libmpg123-0.dll
Size

329KB
MD5

91076302dcebf1af925cb8ff2211d56a
SHA1

2b12382b81b9c84f14c29b41be5173405d696ad0
SHA256

f0e36bf80b152b03ccff9709e2a1b634c70eefb3538575228f80cdbeb0504a81
SHA512

3ca0415d782d8715ce6c90f25bb1f45dfb1534569a1935caf90a242591665e50f37b560a4e87ef4dbf25849cf6f1990ff99e9bd36f6ceb92bdd600880f508699
SSDEEP

6144:uHONz42n45OiGuNgJMnTf4zC1K1t1vvxbrzTv:bNn45dGuN8e6vRrP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2104	1960	rundll32.exe	28
PID 1960 wrote to memory of 2104	1960	rundll32.exe	28
PID 1960 wrote to memory of 2104	1960	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RLuncher_1.5.0.3\Other\App\Edgar\libmpg123-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1960 -s 88
  2⤵
  PID:2104

memory/1960-0-0x0000000063C80000-0x0000000063CEA000-memory.dmp

Filesize
424KB

Download