755d11ba3943ba14071f4bdb5b10d3a1db96fdbf637a2851317304aa2523a4b4

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 09:12

Target

Plugins/FX/reasynth.dll
Size

14KB
MD5

3948dbd01a1b00a05fa7daf0eb5147d7
SHA1

108c5bc25f28c7ec9178840a71c1bc49049af114
SHA256

10455529fba4a91148299c0bec0c8db2609770cfadc530969506c21bcbfc6129
SHA512

e52ebfdedbdfbecc2ec470c47bb9882b6c5d9accf77572885d92574e0c23add4ec48daf74b838c6b3619ffd0d0df12111295592c79ab0c7e5d3775f06245f6ca
SSDEEP

384:Dj18pnEq0zkQQ4BentpqU26LFCYDDWXiVta9fePzR:LxlutpV/3+AymPd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	2472	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2472	772	rundll32.exe	28
PID 772 wrote to memory of 2472	772	rundll32.exe	28
PID 772 wrote to memory of 2472	772	rundll32.exe	28
PID 772 wrote to memory of 2472	772	rundll32.exe	28
PID 772 wrote to memory of 2472	772	rundll32.exe	28
PID 772 wrote to memory of 2472	772	rundll32.exe	28
PID 772 wrote to memory of 2472	772	rundll32.exe	28
PID 2472 wrote to memory of 1964	2472	rundll32.exe	29
PID 2472 wrote to memory of 1964	2472	rundll32.exe	29
PID 2472 wrote to memory of 1964	2472	rundll32.exe	29
PID 2472 wrote to memory of 1964	2472	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reasynth.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reasynth.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 224
    3⤵
    - Program crash
    PID:1964