a13a66488151b47508a2dd043f8010ad91b96638c0b1a6f83ebbb82c4cb4fc5e

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2023, 16:07

Target
RIRS.dll
Size 2.5MB
Sample231120-tk28lahh3t
SHA256 13b18fd073da904d326ad0b54281447a4a1c05678c8d2aa6361fa7f84e95e646
MD5 b668a71aa710b1f08ea5ab5db97e89a4
SHA1 10fc0ffa4850f290d72753129bbdac4369beffed
SHA512 bc9677764290e6fb4a4f912bc70fff9e3e284ccade96f8e14b95e9a36cb3129662d8f21c83fb847497f98d3ad529a6f22e1d67b8f8885d64d404ea69ed638455
SSDEEP 49152:921mU+j4kNwzaKPvghxk1CPwDv3uFmAVpzCTJueu+FNRdonOMyDWgEjGmH9g:9218wzakgDk1CPwDv3uFmAVpzybFNRKy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4264	3900	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3900	4312	rundll32.exe	83
PID 4312 wrote to memory of 3900	4312	rundll32.exe	83
PID 4312 wrote to memory of 3900	4312	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RIRS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RIRS.dll,#1
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 624
    3⤵
    - Program crash
    PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3900 -ip 3900
1⤵
PID:2984