1ce3a42466fb875b1c1e58c5cfb639cff11955b3017ee987b5f7ed8edd4c39f3

Analysis

max time kernel
86s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10-09-2022 14:42

Target

packages/Program Files (x86)/VstPlugins/FL Studio VSTi.dll
Size

2.3MB
MD5

1c1cb10232e973e50a8f3ebdefdd838c
SHA1

bbe8e2f52d22609342ade9349e87319d81e82beb
SHA256

4cde6dc9770c903a931a6e23f4c5ddb6793772b53d233d3b33d2482a29272233
SHA512

852c553c1806f3058e234ffc1b2846ae0e9991ee587208bc1565c14d9625578f64008cdaccadd071f165c5cf8c550aeeff244013811d2403014f2a8aa5ac2508
SSDEEP

24576:gacqwzcGeFEYYena94frJXZfHZhR2OKu4r+MeTKirXGWdXg3uD02+KMwMn4xoIT5:1ocfHKt8KirXZw3I02+KMw+4dTb2iIO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1376 1416 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1376	1416	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1124 wrote to memory of 1416	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1416	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1416	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1416	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1416	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1416	1124	rundll32.exe	rundll32.exe
PID 1124 wrote to memory of 1416	1124	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 1376	1416	rundll32.exe	WerFault.exe
PID 1416 wrote to memory of 1376	1416	rundll32.exe	WerFault.exe
PID 1416 wrote to memory of 1376	1416	rundll32.exe	WerFault.exe
PID 1416 wrote to memory of 1376	1416	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\packages\Program Files (x86)\VstPlugins\FL Studio VSTi.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\packages\Program Files (x86)\VstPlugins\FL Studio VSTi.dll",#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 268
3⤵
- Program crash
PID:1376

memory/1376-57-0x0000000000000000-mapping.dmp

Download
memory/1416-54-0x0000000000000000-mapping.dmp

Download
memory/1416-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1416-56-0x0000000002280000-0x00000000024E3000-memory.dmp

Filesize
2.4MB

Download