755d11ba3943ba14071f4bdb5b10d3a1db96fdbf637a2851317304aa2523a4b4

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 09:12

Target

Plugins/FX/reasyndr.dll
Size

10KB
MD5

04799ecfef3a685d1230e36c55994c4a
SHA1

c6ca5699f3005fd99e8cdf5e6c62a6e3f66cdc91
SHA256

f064d2185ff28c8731fd225d3add83bec05478d1efa1f3590d877817038e6e78
SHA512

af56df2d52634b659b6a976ab5ee0461770b0c2e64dfd21f3889622c3f792936cab77e2374bf053c09929d2cc454a264cb0a53b11bc1126a6a3f105404d89daf
SSDEEP

192:lZKO1+51S0d6zrICBGMVYzADKfpIqy88UIwWwQJVUa:lh1mdc9+fpXoUijD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1936	1208	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1208	2056	rundll32.exe	28
PID 2056 wrote to memory of 1208	2056	rundll32.exe	28
PID 2056 wrote to memory of 1208	2056	rundll32.exe	28
PID 2056 wrote to memory of 1208	2056	rundll32.exe	28
PID 2056 wrote to memory of 1208	2056	rundll32.exe	28
PID 2056 wrote to memory of 1208	2056	rundll32.exe	28
PID 2056 wrote to memory of 1208	2056	rundll32.exe	28
PID 1208 wrote to memory of 1936	1208	rundll32.exe	29
PID 1208 wrote to memory of 1936	1208	rundll32.exe	29
PID 1208 wrote to memory of 1936	1208	rundll32.exe	29
PID 1208 wrote to memory of 1936	1208	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reasyndr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reasyndr.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 224
    3⤵
    - Program crash
    PID:1936