990bcaf138c29483b5573089b243cc6f4751ccd521148297130e3e36aa70e9f8

Analysis

max time kernel
422s
max time network
426s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 14:44

Target

bin/RFIDAPI.dll
Size

112KB
MD5

4d55b581187d89f6ce0fffd058e4cf1b
SHA1

2e1cef6bceae374a5b393ac86b6ce60a4ff5613e
SHA256

1de2962cb7fcdc9d47b63627381f3e6b345c32f16be570b45e0847cf1931d52d
SHA512

e4de041bc4721824f6979e6f283c763532aae17a65c55abeedbe252627b0260f83c197ac5f45f8c309d5256106a81e82bd817b8358846e9c9b930cd88a9daf81
SSDEEP

3072:XgsQoXvTwfddjn0HruUgS5ZJSESk1R5sEnLNGY/L3SQMCEKOgx2kyI:X0oXvTwfddjn0HruUgS5ZJSESkL5sEnZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2036 1032 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2036	1032	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1032	1972	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 2036	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 2036	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 2036	1032	rundll32.exe	WerFault.exe
PID 1032 wrote to memory of 2036	1032	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\RFIDAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\RFIDAPI.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 232
3⤵
- Program crash
PID:2036

memory/1032-54-0x0000000000000000-mapping.dmp

Download
memory/1032-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/2036-56-0x0000000000000000-mapping.dmp

Download