1ce3a42466fb875b1c1e58c5cfb639cff11955b3017ee987b5f7ed8edd4c39f3

Analysis

max time kernel
78s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-09-2022 14:42

Target

packages/Program Files (x86)/VstPlugins/FL Studio VSTi (Multi).dll
Size

2.3MB
MD5

a127a44f247c0b659f2b65eceed3298a
SHA1

c015ed730f0178a34b19551234280b114d579fdb
SHA256

37a32270ecd95d19b9944f72238b42ee55fe257a91f90b0aa661313d3c8919aa
SHA512

c40010d96d322581f6f10d665e3a5bb98305b4a5e43420aad293599341493c19c75d2f3d17eb8adad94adf201c502ff02a00bb3f6fd8d08b79fb0c014d591410
SSDEEP

24576:KacqwzcGeFEYYena94frJXZfHZhR2OKu4r+MeTKirXGWdXg3uD02+KMwMn4x5ITW:rocfHKt8KirXZw3I02+KMw+4ETbQimoI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1252 1000 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1252	1000	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1780 wrote to memory of 1000	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 1000	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 1000	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 1000	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 1000	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 1000	1780	rundll32.exe	rundll32.exe
PID 1780 wrote to memory of 1000	1780	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1252	1000	rundll32.exe	WerFault.exe
PID 1000 wrote to memory of 1252	1000	rundll32.exe	WerFault.exe
PID 1000 wrote to memory of 1252	1000	rundll32.exe	WerFault.exe
PID 1000 wrote to memory of 1252	1000	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\packages\Program Files (x86)\VstPlugins\FL Studio VSTi (Multi).dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\packages\Program Files (x86)\VstPlugins\FL Studio VSTi (Multi).dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 268
3⤵
- Program crash
PID:1252

memory/1000-54-0x0000000000000000-mapping.dmp

Download
memory/1000-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1000-56-0x0000000001FE0000-0x0000000002243000-memory.dmp

Filesize
2.4MB

Download
memory/1252-57-0x0000000000000000-mapping.dmp

Download