506da932f06c1b88ddda7133a5a0711254f24dd6d7dd2ecf4ecdd3c4e780a307

Analysis

max time kernel
80s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2023 01:08

Target

F0nts/Plugins/libs/revulytics/ruiSDK_5.5.0.x86.dll
Size

754KB
MD5

f883c90d9c7f3e78aa198e04a87ae709
SHA1

b417944bc976ba1e60dbfeb803d25e73bef20872
SHA256

947940a221666fb066cd7e795ffa1ab868bd77e8fc0b06c9aec61a99fb63d00f
SHA512

2e46e42e6bd1c6f90554c7523047bd19bec8238d43636ea600bd4d9602d549258cc5ef69fd2c9f2d3e38dbef6d398f28ae160486953ce9296967d1abd46477ea
SSDEEP

12288:bNOa/XnNTEFk9I+9wMmhXvoXbZO8AbdGfOMmJZmxssN5TfneYQfD3w:Mae8I+9HhO8AbddLjSssN5Tfw7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4016 1596 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4016	1596	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1000 wrote to memory of 1596	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1596	1000	rundll32.exe	rundll32.exe
PID 1000 wrote to memory of 1596	1000	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F0nts\Plugins\libs\revulytics\ruiSDK_5.5.0.x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\F0nts\Plugins\libs\revulytics\ruiSDK_5.5.0.x86.dll,#1
2⤵
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 644
3⤵
- Program crash
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1596 -ip 1596
1⤵
PID:1348