a13a66488151b47508a2dd043f8010ad91b96638c0b1a6f83ebbb82c4cb4fc5e

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2023 16:07

Target

RIRS.dll
Size

2.5MB
MD5

b668a71aa710b1f08ea5ab5db97e89a4
SHA1

10fc0ffa4850f290d72753129bbdac4369beffed
SHA256

13b18fd073da904d326ad0b54281447a4a1c05678c8d2aa6361fa7f84e95e646
SHA512

bc9677764290e6fb4a4f912bc70fff9e3e284ccade96f8e14b95e9a36cb3129662d8f21c83fb847497f98d3ad529a6f22e1d67b8f8885d64d404ea69ed638455
SSDEEP

49152:921mU+j4kNwzaKPvghxk1CPwDv3uFmAVpzCTJueu+FNRdonOMyDWgEjGmH9g:9218wzakgDk1CPwDv3uFmAVpzybFNRKy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4264 3900 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4264	3900	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4312 wrote to memory of 3900	4312	rundll32.exe	rundll32.exe
PID 4312 wrote to memory of 3900	4312	rundll32.exe	rundll32.exe
PID 4312 wrote to memory of 3900	4312	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RIRS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RIRS.dll,#1
2⤵
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 624
3⤵
- Program crash
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3900 -ip 3900
1⤵
PID:2984