83ac3aa3ddb2b4e61e491fd285964333d0aff50a48cc2d19648f4b29f2166cf8

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 07:27

Target

$TEMP/R2RS1KG2.dll
Size

729KB
MD5

90f4d27517acc223d1698e6d189861e9
SHA1

070ca52f21232bbd9e1e99ef87a339dea43efb0b
SHA256

d53db9201a4a0ba627f107739398be8b16e8618d06fa88eed476026a43a4cc6e
SHA512

289daf70f5e97b304721ec249cac284f621c6606b84e832049747f264be464acbf7f9dfdbe7b39b18ea1c25754158cb0fa472b70ab70a9a3b3163acba2a308cd
SSDEEP

12288:5dvLDWGJ0E2gUPxrDIRYB/0hzYSmujEMPYKHWkQTnl1wEFHysG56E982x8ozOGzH:5dvLDWGr2/xpSmuUnlI6U82RzaE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	1684	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1684	1128	rundll32.exe	85
PID 1128 wrote to memory of 1684	1128	rundll32.exe	85
PID 1128 wrote to memory of 1684	1128	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RS1KG2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\R2RS1KG2.dll,#1
  2⤵
  PID:1684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 632
    3⤵
    - Program crash
    PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1684 -ip 1684
1⤵
PID:2000