990bcaf138c29483b5573089b243cc6f4751ccd521148297130e3e36aa70e9f8

Analysis

max time kernel
508s
max time network
515s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2022 14:44

Target

bin/RFIDAPI.dll
Size

112KB
MD5

4d55b581187d89f6ce0fffd058e4cf1b
SHA1

2e1cef6bceae374a5b393ac86b6ce60a4ff5613e
SHA256

1de2962cb7fcdc9d47b63627381f3e6b345c32f16be570b45e0847cf1931d52d
SHA512

e4de041bc4721824f6979e6f283c763532aae17a65c55abeedbe252627b0260f83c197ac5f45f8c309d5256106a81e82bd817b8358846e9c9b930cd88a9daf81
SSDEEP

3072:XgsQoXvTwfddjn0HruUgS5ZJSESk1R5sEnLNGY/L3SQMCEKOgx2kyI:X0oXvTwfddjn0HruUgS5ZJSESkL5sEnZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2480 3468 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2480	3468	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4332 wrote to memory of 3468	4332	rundll32.exe	rundll32.exe
PID 4332 wrote to memory of 3468	4332	rundll32.exe	rundll32.exe
PID 4332 wrote to memory of 3468	4332	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\RFIDAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4332

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\RFIDAPI.dll,#1
2⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 616
3⤵
- Program crash
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3468 -ip 3468
1⤵
PID:5012