66d98baccf204383ee64d744e01305be78428acb6218042f8bdea6bcda82a8b6

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 17:26

Target

Plugins/FX/reacontrolmidi.dll
Size

376KB
MD5

ec40310d553e2b6be6cc7856af168d75
SHA1

997eaf3f3a61f99ab89d2215dd3017554a3aa013
SHA256

73104cd163eed073ff700afb729c0afda41ebf0d4fa83ec2d168f09832d817f1
SHA512

2febe9bb200d77d2625ba913868c098ba35a97e8f8d336307e1a1eca0547c67903fed6d7bde55eae781aaee449fbb526cd0d3162e2003416b2ada5e1912a0ab2
SSDEEP

6144:6ZCy9WR1pAfQfeZJAwPT5uneHi3E9bWm5DxuHWj1GHbANhHROSDctZOFZJfBedJd:6oRntFIT51DmSoU1Ret4JJq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3040	3032	rundll32.exe	30
PID 3032 wrote to memory of 3040	3032	rundll32.exe	30
PID 3032 wrote to memory of 3040	3032	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reacontrolmidi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3032 -s 168
  2⤵
  PID:3040