9fd10bf47b3cc8064550344ccc5bd40f94072ccca78254b7e464ec6f8bcf03ca

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 09:51

Target

SkySky/fntestdll.dll
Size

112KB
MD5

222cb728a576c5e11a4f2544eeef52da
SHA1

9a4e98a2b63f662dcfff955c31f4e0859adf0964
SHA256

6e813ceecf905b9a769c88d0a6909749c9758fa166351fe5cb74f99f7090dd2f
SHA512

5bf3d19e0a1d6594097fa2cc7830c31cdf72da54da9d6d2ba8d69571c588363cd358675e2074b29d0365be6ff328121178b3486e7073aa3dc70d7e9f877c4f22
SSDEEP

1536:jGAml8LXVT/ZKCjNCF8k8gWkug+hXG2OL5Udp7FtsWn5s:jvLfhjb/kQVa+dp5tj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	2760	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2760	1968	rundll32.exe	28
PID 1968 wrote to memory of 2760	1968	rundll32.exe	28
PID 1968 wrote to memory of 2760	1968	rundll32.exe	28
PID 1968 wrote to memory of 2760	1968	rundll32.exe	28
PID 1968 wrote to memory of 2760	1968	rundll32.exe	28
PID 1968 wrote to memory of 2760	1968	rundll32.exe	28
PID 1968 wrote to memory of 2760	1968	rundll32.exe	28
PID 2760 wrote to memory of 2028	2760	rundll32.exe	29
PID 2760 wrote to memory of 2028	2760	rundll32.exe	29
PID 2760 wrote to memory of 2028	2760	rundll32.exe	29
PID 2760 wrote to memory of 2028	2760	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkySky\fntestdll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkySky\fntestdll.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 232
    3⤵
    - Program crash
    PID:2028

memory/2760-0-0x00000000000B0000-0x00000000000BC000-memory.dmp

Filesize
48KB

Download