1ce3a42466fb875b1c1e58c5cfb639cff11955b3017ee987b5f7ed8edd4c39f3

Analysis

max time kernel
121s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2022 14:42

Target

packages/Program Files (x86)/VstPlugins/FL Studio VSTi.dll
Size

2.3MB
MD5

1c1cb10232e973e50a8f3ebdefdd838c
SHA1

bbe8e2f52d22609342ade9349e87319d81e82beb
SHA256

4cde6dc9770c903a931a6e23f4c5ddb6793772b53d233d3b33d2482a29272233
SHA512

852c553c1806f3058e234ffc1b2846ae0e9991ee587208bc1565c14d9625578f64008cdaccadd071f165c5cf8c550aeeff244013811d2403014f2a8aa5ac2508
SSDEEP

24576:gacqwzcGeFEYYena94frJXZfHZhR2OKu4r+MeTKirXGWdXg3uD02+KMwMn4xoIT5:1ocfHKt8KirXZw3I02+KMw+4dTb2iIO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

608 4656 WerFault.exe rundll32.exe

pid	pid_target	process	target process
608	4656	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4072 wrote to memory of 4656	4072	rundll32.exe	rundll32.exe
PID 4072 wrote to memory of 4656	4072	rundll32.exe	rundll32.exe
PID 4072 wrote to memory of 4656	4072	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\packages\Program Files (x86)\VstPlugins\FL Studio VSTi.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\packages\Program Files (x86)\VstPlugins\FL Studio VSTi.dll",#1
2⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 692
3⤵
- Program crash
PID:608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4656 -ip 4656
1⤵
PID:1528

memory/4656-132-0x0000000000000000-mapping.dmp

Download
memory/4656-133-0x0000000001F70000-0x00000000021D3000-memory.dmp

Filesize
2.4MB

Download
memory/4656-134-0x0000000001F71000-0x0000000002159000-memory.dmp

Filesize
1.9MB

Download