1b2a98b260fdd6438b739f14c2cc7f6f899178444c791d8241754fa9345328e0

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 11:20

Target

YQL_Lyrics_Common.dll
Size

505KB
MD5

72dbbf502f310b3820ff4589cf4e9ae7
SHA1

710871a5957a7e3932b7ef2a8990cc133afa8058
SHA256

4549c30b9bf613d757e139b8f0f55294b04b6297aa358ef85dbe71bd6b4235c8
SHA512

a9ebc84313ec4dd876c2f6b274297c4d2d244a5dfcfa05f6b2d23145107c39278e7679c0eb230463f72e2da817ed8b62b3b6b4621da3e0ef13e438c4726b689d
SSDEEP

6144:SH3PvjePZck+afKQpn0qYUwhpRfh2pT41VrRBE1JOsgXf08/OlA:S3SPlPFd0qYVplheT8rnE1/W/r

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28
PID 2408 wrote to memory of 2468	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YQL_Lyrics_Common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\YQL_Lyrics_Common.dll,#1
  2⤵
  PID:2468