9c3dd40b4539a812baabc3b8e1cec9ae45a39ec8d799c1bd6e53d9d64a2366f0

Resubmissions

07-07-2024 20:29

07-07-2024 20:21

20-04-2024 11:56

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
07-07-2024 20:21

Target

$_27_/Auburn Sounds Graillon 2.dll
Size

2.4MB
MD5

9b6953c41811355a418269e4fcf3ee4d
SHA1

629e470a051ebf84b53eb0819238f8e2c60a2929
SHA256

33bb3fabe7c08cd9ebf5f5aded545720bc9628aee89debbbf676e38af8f20818
SHA512

129f4a25109b1311ee90e963c3d9d11cc5fd9d414d1e5989cac2f826c4b0b3273239b8690259f6ba55a568ef38f4424c898f4f37fa80702917773f5a2e77eb5b
SSDEEP

24576:nKzMoNy9b5HRrd+3xZEVrL3HxOYOYPqfxpluPTW0Gxk/q8PeWHqbP7VqzAbqsOGj:nK3Yb/yEexU3hBHqbDVq7V0Y/UP+LNjQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5064	1088	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 1088	4852	rundll32.exe	80
PID 4852 wrote to memory of 1088	4852	rundll32.exe	80
PID 4852 wrote to memory of 1088	4852	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$_27_\Auburn Sounds Graillon 2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$_27_\Auburn Sounds Graillon 2.dll",#1
  2⤵
  PID:1088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 548
    3⤵
    - Program crash
    PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1088 -ip 1088
1⤵
PID:3096