c640adc8c6c82e658ccc5595ac2ca3c1c226a87206ae8a1e31c3db261aeac0df

Analysis

max time kernel
40s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-02-2023 13:11

Target

bios.dll
Size

1.1MB
MD5

ce2c902fd0ce18854cdb470b1a02d430
SHA1

8c1ab975f7c6aefc03eb9809fc3b352ce2d92c02
SHA256

ea3a26bb3e6dd0aef0685ce38aeac6fcd9f4b3ee8380d93cc6a63330c5afbfd8
SHA512

9d3ac80a152ef0d8fa8461013eff9faf3432e652f4292c0cfd427f92e14d8ed67507a4b2f0596050a7997af872324fdd1057da6d7bf4ab0daed4ed3616eacdcf
SSDEEP

12288:78xoBeGLj79ko/Kw5D/4u5VhB6FXW8oI4pojoUVPn3mR7QJjmLB2HwjsjJlH0Ycn:Ix0lL5/KsDZBWG8UUVPn2u3HFjJ20

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	784	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1952	784	rundll32.exe	28
PID 784 wrote to memory of 1952	784	rundll32.exe	28
PID 784 wrote to memory of 1952	784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bios.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 784 -s 84
  2⤵
  - Program crash
  PID:1952