23d8d581d8be6247b1074913acdc72ecfcb30c03c543773f1b62bb0b8686f9ee

Analysis

max time kernel
36s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/09/2022, 05:05

Target

sKw˪c餤/bin/fp20utl.dll
Size

621KB
MD5

6de0416b33c3d324a62c634f7b71e79d
SHA1

12dd6036a09209ee5bb743a512706f0a1bb2bcec
SHA256

d581dfc3efbe738c3938428bf3776ddb46137ddd7dd1fc5316c80fe986bcc4bb
SHA512

09ff98006821b4aefb23e04aa4e1ce5393c5a4cbac885f08d14fe61c2ec463c82769c0ad74db1fbaf0072cf8088025d0f58bf51ccd567a228934f52b6e98ed25
SSDEEP

6144:+0PMgQEF5hyrRhxT7Qb4JYFlxzjruJnwq90bwlathxSq3njQ58M:tkchaxuyx90BtzLjQ58M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	1116	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1472 wrote to memory of 1116	1472	rundll32.exe	27
PID 1116 wrote to memory of 1292	1116	rundll32.exe	28
PID 1116 wrote to memory of 1292	1116	rundll32.exe	28
PID 1116 wrote to memory of 1292	1116	rundll32.exe	28
PID 1116 wrote to memory of 1292	1116	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sKw˪c餤\bin\fp20utl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sKw˪c餤\bin\fp20utl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 232
    3⤵
    - Program crash
    PID:1292

memory/1116-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1116-56-0x0000000000120000-0x0000000000139000-memory.dmp

Filesize
100KB

Download
memory/1116-57-0x0000000000190000-0x00000000001B2000-memory.dmp

Filesize
136KB

Download