506da932f06c1b88ddda7133a5a0711254f24dd6d7dd2ecf4ecdd3c4e780a307

Analysis

max time kernel
17s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-04-2023 01:08

Target

F0nts/Plugins/libs/revulytics/ruiSDK_5.5.0.x86.dll
Size

754KB
MD5

f883c90d9c7f3e78aa198e04a87ae709
SHA1

b417944bc976ba1e60dbfeb803d25e73bef20872
SHA256

947940a221666fb066cd7e795ffa1ab868bd77e8fc0b06c9aec61a99fb63d00f
SHA512

2e46e42e6bd1c6f90554c7523047bd19bec8238d43636ea600bd4d9602d549258cc5ef69fd2c9f2d3e38dbef6d398f28ae160486953ce9296967d1abd46477ea
SSDEEP

12288:bNOa/XnNTEFk9I+9wMmhXvoXbZO8AbdGfOMmJZmxssN5TfneYQfD3w:Mae8I+9HhO8AbddLjSssN5Tfw7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

860 2012 WerFault.exe rundll32.exe

pid	pid_target	process	target process
860	2012	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1740 wrote to memory of 2012	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2012	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2012	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2012	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2012	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2012	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 2012	1740	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 860	2012	rundll32.exe	WerFault.exe
PID 2012 wrote to memory of 860	2012	rundll32.exe	WerFault.exe
PID 2012 wrote to memory of 860	2012	rundll32.exe	WerFault.exe
PID 2012 wrote to memory of 860	2012	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F0nts\Plugins\libs\revulytics\ruiSDK_5.5.0.x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F0nts\Plugins\libs\revulytics\ruiSDK_5.5.0.x86.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 256
3⤵
- Program crash
PID:860