a13a66488151b47508a2dd043f8010ad91b96638c0b1a6f83ebbb82c4cb4fc5e

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
20-11-2023 16:07

Target

RIRS.dll
Size

2.5MB
MD5

b668a71aa710b1f08ea5ab5db97e89a4
SHA1

10fc0ffa4850f290d72753129bbdac4369beffed
SHA256

13b18fd073da904d326ad0b54281447a4a1c05678c8d2aa6361fa7f84e95e646
SHA512

bc9677764290e6fb4a4f912bc70fff9e3e284ccade96f8e14b95e9a36cb3129662d8f21c83fb847497f98d3ad529a6f22e1d67b8f8885d64d404ea69ed638455
SSDEEP

49152:921mU+j4kNwzaKPvghxk1CPwDv3uFmAVpzCTJueu+FNRdonOMyDWgEjGmH9g:9218wzakgDk1CPwDv3uFmAVpzybFNRKy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2208 2184 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2208	2184	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2120 wrote to memory of 2184	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 2184	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 2184	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 2184	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 2184	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 2184	2120	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 2184	2120	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 2208	2184	rundll32.exe	WerFault.exe
PID 2184 wrote to memory of 2208	2184	rundll32.exe	WerFault.exe
PID 2184 wrote to memory of 2208	2184	rundll32.exe	WerFault.exe
PID 2184 wrote to memory of 2208	2184	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RIRS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RIRS.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 224
3⤵
- Program crash
PID:2208