f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2022 17:24

Target

f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea.dll
Size

144KB
MD5

b61fc9a022e91ce3b16b5ee134c7006f
SHA1

f16f25c494f48cd922b587a8d14ee0ca5e20580a
SHA256

f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea
SHA512

10c10d0c84daf7233f835ef4f384b8daf26c811d2ec45c92cb32fad2fa720206fe5a302e1591c9b2baec578dcd534201cf7bce7451d91f8cff12b7223d1a7069

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	2108	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2108	regsvr32.exe
2108	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2108	4868	regsvr32.exe	78
PID 4868 wrote to memory of 2108	4868	regsvr32.exe	78
PID 4868 wrote to memory of 2108	4868	regsvr32.exe	78

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f514fc38d05bc89fe42fede52437bd40fd1e92c02039c64bbf3d67eef79117ea.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 1252
    3⤵
    - Program crash
    PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2108 -ip 2108
1⤵
PID:1108