f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:54

Target

FisheyeCtrl.dll
Size

72KB
MD5

2c9b2188cac2406034ed41671c9e76ba
SHA1

428b051ab03bccb9fa24153a251da4b8f287db84
SHA256

572841ac1ee7332ee457d1126a2b4fea4affb463574dfd8f95a6fe75806be7ec
SHA512

55e41af2e2feb6a947dd0cd7ae3de336288984fb738b4e11ac88991f58fe7c77b4a806f3a1b7ba9cf8641bf66fdfab2e891d551758c33f56f2e2e9656cf4f338
SSDEEP

768:FQVefkqOwAQ67JwA+eKNavkeUX2wLjeTAecKEebJYDCHeL4zsb9L/sqMB3Cx3Fz:GkcqOwAt7JwMvIe/sxLkqMB3Cx35

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2740 1636 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2740	1636	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1680 wrote to memory of 1636	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1636	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1636	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1636	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1636	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1636	1680	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 1636	1680	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 2740	1636	rundll32.exe	WerFault.exe
PID 1636 wrote to memory of 2740	1636	rundll32.exe	WerFault.exe
PID 1636 wrote to memory of 2740	1636	rundll32.exe	WerFault.exe
PID 1636 wrote to memory of 2740	1636	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FisheyeCtrl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FisheyeCtrl.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 244
3⤵
- Program crash
PID:2740