d24d1726864be6bf4458f9c23ab89c03506bbb7d662cb68c27dff4c97e560e91

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 07:13

Target

bin/CKuwoPlayer.dll
Size

165KB
MD5

c9b2114962bbac06146f1b372cea5e8f
SHA1

a231b63a62650250dadbfab9a241a64fe1c1f29e
SHA256

9e31fbe41bc962f91aecdbb823a3ec313013b1e7e5f3acb71d17ea91d5e46c34
SHA512

bbc3baa330ec79616eb7ee38d9cd298e69be5bf8bb3f46192c3e38121231838953f62caaa89f4996c147fcad98cc6cd16cb25da46b9e3c66ade36f2d844a27e7
SSDEEP

3072:2v5P+NCopsu3+tEbzNfyva2YriUW1q/lMwjAn5IonjOXkGPOyPQNoO:ZF4Ev2Yrio/25IUKNPOyPyoO

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Log	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\Conf	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\Conf\Default	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2372	2844	rundll32.exe	83
PID 2844 wrote to memory of 2372	2844	rundll32.exe	83
PID 2844 wrote to memory of 2372	2844	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\CKuwoPlayer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\CKuwoPlayer.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2372

memory/2372-0-0x0000000000E00000-0x0000000000E0D000-memory.dmp

Filesize
52KB

Download
memory/2372-1-0x0000000002720000-0x000000000274A000-memory.dmp

Filesize
168KB

Download
memory/2372-4-0x0000000002770000-0x00000000027B7000-memory.dmp

Filesize
284KB

Download
memory/2372-5-0x0000000002800000-0x0000000002827000-memory.dmp

Filesize
156KB

Download
memory/2372-6-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download