2bba05f9769bd1ae9620ad64421955575bfbdb145e551bedcf55cad61a0819e5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 14:12

Target
$PLUGINSDIR/ftzcfimfl.dll
Size 31KB
Sample240405-rh56cseb51
SHA256 c8b41f14eb72a177801664827eb9942534a410678a37894566fd09fc7e7dbcb4
MD5 25e960f61eb87320c923a7cd60280f35
SHA1 849dfc82b9ff6235c663993ba9924ab1f2a0213b
SHA512 42f3fc92d9b2778c3a8d5ef9edce3e8778b2fb414b59573efdcba88c4b73245c4f255cd15a6c46f77a30738bcf8e3636bdddd28be7df81403755400ebef71270
SSDEEP 384:5pHCFR+Fe3ffVNHKFOQAFVVK9rl0ngCz4QWm81g3C7X8C4oVYQ20oXQ7KudmrdA6:/CBPNpKFaXgrPCz/8jXemYQotudmZA6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1240	2028	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2028	2156	rundll32.exe	28
PID 2156 wrote to memory of 2028	2156	rundll32.exe	28
PID 2156 wrote to memory of 2028	2156	rundll32.exe	28
PID 2156 wrote to memory of 2028	2156	rundll32.exe	28
PID 2156 wrote to memory of 2028	2156	rundll32.exe	28
PID 2156 wrote to memory of 2028	2156	rundll32.exe	28
PID 2156 wrote to memory of 2028	2156	rundll32.exe	28
PID 2028 wrote to memory of 1240	2028	rundll32.exe	29
PID 2028 wrote to memory of 1240	2028	rundll32.exe	29
PID 2028 wrote to memory of 1240	2028	rundll32.exe	29
PID 2028 wrote to memory of 1240	2028	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ftzcfimfl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ftzcfimfl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 280
    3⤵
    - Program crash
    PID:1240