b92b4f05ced0a9d216725f0d4e1faf7ff850b834e0f1ffa1d79423ee071d92cc

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 15:34

Target

Plugins/enc_flac.dll
Size

32KB
MD5

c993c9b01312ed30da84ad362e5a3f96
SHA1

06429041ba0a96cde49a7b7efdc1a79a53d5d7bf
SHA256

bcaff7d7182769279ed0729c8b0418f11c04508dc869832eb14485c00bb65f48
SHA512

a0515d20c53b0a0d739214ad646b37323a785ea49e825d159b607bc8fc161c915c298caed68221b91ca4c8e597762e8908a8422e10452dac236a00dd057be641
SSDEEP

384:Mtho/zBpmucq//oZsp4nADc3IMR0jpm8VbNBVIFN7MRb+F0L5Pd6r5:oyzTm2/9p4nADc3qpmmbNK7sK0FV61

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4996	3976	rundll32.exe	84
PID 3976 wrote to memory of 4996	3976	rundll32.exe	84
PID 3976 wrote to memory of 4996	3976	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\enc_flac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\enc_flac.dll,#1
  2⤵
  PID:4996