150ac1fb1dfc122655f683b3ec40e672d815c03699fb68a69917eb7b8ae8373d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07/03/2025, 23:45

Target

discord_voice/mediapipe.dll
Size

5.9MB
MD5

dfcfc79f1777433834f594bdbc6c25c1
SHA1

0764397992250275b0c524a228fb9057c2315ec2
SHA256

3b44af220ed9258e33811f93655e8b1220c828ae76380c05795447dde508ec25
SHA512

23d3c8ec3fa9399ca24620f9b90c84486731528481399c10f752396ad8261185f30747da646952542daa08eb58eb4d94dd2a62d2112c5fd1f4725b00f251e793
SSDEEP

49152:2XgvfPGAH0A1LjUkwJ25HkLyKTnWSdsCECELRvVXkykLoObNf2pAmgbxbLEDwNbg:kOLxfCNCnu4g+iM4PkqfV2e4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2644	3064	rundll32.exe	30
PID 3064 wrote to memory of 2644	3064	rundll32.exe	30
PID 3064 wrote to memory of 2644	3064	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\discord_voice\mediapipe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3064 -s 80
  2⤵
  PID:2644