e95b5f032ed246f3f9c0bc27017e46940056f5c5fa3dbb7b2f6e0c965e69a4f2

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 16:27

Target

YQL_Lyrics_Common.dll
Size

505KB
MD5

72dbbf502f310b3820ff4589cf4e9ae7
SHA1

710871a5957a7e3932b7ef2a8990cc133afa8058
SHA256

4549c30b9bf613d757e139b8f0f55294b04b6297aa358ef85dbe71bd6b4235c8
SHA512

a9ebc84313ec4dd876c2f6b274297c4d2d244a5dfcfa05f6b2d23145107c39278e7679c0eb230463f72e2da817ed8b62b3b6b4621da3e0ef13e438c4726b689d
SSDEEP

6144:SH3PvjePZck+afKQpn0qYUwhpRfh2pT41VrRBE1JOsgXf08/OlA:S3SPlPFd0qYVplheT8rnE1/W/r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 4836	3408	rundll32.exe	80
PID 3408 wrote to memory of 4836	3408	rundll32.exe	80
PID 3408 wrote to memory of 4836	3408	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\YQL_Lyrics_Common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\YQL_Lyrics_Common.dll,#1
  2⤵
  PID:4836