e85728ae8f1fe75179330540e6c726be67deb6f571ba76c215e36e87b2f3cb77

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07-11-2023 09:02

Target

Debug/SSCardDriver.dll
Size

1.6MB
MD5

4ae9411bf388915f9900bcc04128195c
SHA1

2375a80872da8330045c14eec4ed0269c6935363
SHA256

84132855f21969c29733cdd9fba65c74fa3697b4a092fccbaaacc2bcce7b2293
SHA512

8ff177250f921785787fee8e32808a68d28149c4419e6e72c6467f4b0683f0dd0a8370e3c2049cd3d6cf61c0e0046c893249be09859c09f99f6e673e8e2b00d6
SSDEEP

49152:PgfcLxgQmM2vdxBuzHViszueYg4zHV8khjImGiUPm22Qea7:YcmzVdxBuzHVbztl4zHT+mGi+2Qea

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	2656	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2656	2040	rundll32.exe	28
PID 2040 wrote to memory of 2656	2040	rundll32.exe	28
PID 2040 wrote to memory of 2656	2040	rundll32.exe	28
PID 2040 wrote to memory of 2656	2040	rundll32.exe	28
PID 2040 wrote to memory of 2656	2040	rundll32.exe	28
PID 2040 wrote to memory of 2656	2040	rundll32.exe	28
PID 2040 wrote to memory of 2656	2040	rundll32.exe	28
PID 2656 wrote to memory of 2272	2656	rundll32.exe	29
PID 2656 wrote to memory of 2272	2656	rundll32.exe	29
PID 2656 wrote to memory of 2272	2656	rundll32.exe	29
PID 2656 wrote to memory of 2272	2656	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\SSCardDriver.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\SSCardDriver.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 284
    3⤵
    - Program crash
    PID:2272