2a1ceca155e85ad7430a5fc100b9fd5b79873e61ed13a2123b8287c27b9579a1

Analysis

max time kernel
161s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 12:15

Target

irmfmodulewin32.dll
Size

5.7MB
MD5

c048c29dd017beda7f54607f9e416353
SHA1

e0dba3316c85acd9662629f2c7e391dc7846275f
SHA256

2a1ceca155e85ad7430a5fc100b9fd5b79873e61ed13a2123b8287c27b9579a1
SHA512

c4bb6cfecd58759a556071db1034e34ae77bbece70176360d782d5fa27e83f1284cbb05cd1a96a76827361894313844b7d12d8539f4021993ad0350cbcc4a71a
SSDEEP

98304:Mpmkl7uAEuvs0UFD5VyU66URkLC8Ct81Eae1JqI3YL8SFlWC2nCArWQY14XJcvwz:wl7rEuXUlBikLC8Cy1Eae1JqI3YL8Spq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	1272	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1272	1936	rundll32.exe	83
PID 1936 wrote to memory of 1272	1936	rundll32.exe	83
PID 1936 wrote to memory of 1272	1936	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\irmfmodulewin32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\irmfmodulewin32.dll,#1
  2⤵
  PID:1272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 616
    3⤵
    - Program crash
    PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1272 -ip 1272
1⤵
PID:4464