f33817b29ed0782e1e8cbec452a45a84a5d0dc8e724fd4cb6965adc0800eeed2

Analysis

max time kernel
164s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 23:03

Target

f33817b29ed0782e1e8cbec452a45a84a5d0dc8e724fd4cb6965adc0800eeed2.dll
Size

120KB
MD5

6e676e8bd7ead7cfbfcfbbcbfbd45217
SHA1

00f36114979bb1791e6cf4163a9ff2f968e351b0
SHA256

f33817b29ed0782e1e8cbec452a45a84a5d0dc8e724fd4cb6965adc0800eeed2
SHA512

64edb1b1e8fcae2bc9a6d2e9b8f66bb22bb5e833bcbde0f605241deb03588236d92b69190f0aced6e1bb81f586d4c914f364bd95ed9e3bd769e131b45932eac0
SSDEEP

1536:z01RqWQYf1xH9WtKCW4WIXgRRmeq0ffShBU8qubTx2w:ApRfrcECnWIXcme5fSA85lX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5056	2580	WerFault.exe	60

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 2580	3780	regsvr32.exe	60
PID 3780 wrote to memory of 2580	3780	regsvr32.exe	60
PID 3780 wrote to memory of 2580	3780	regsvr32.exe	60

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f33817b29ed0782e1e8cbec452a45a84a5d0dc8e724fd4cb6965adc0800eeed2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f33817b29ed0782e1e8cbec452a45a84a5d0dc8e724fd4cb6965adc0800eeed2.dll
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 636
    3⤵
    - Program crash
    PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2580 -ip 2580
1⤵
PID:3836

memory/2580-133-0x00000000007C0000-0x00000000007DE000-memory.dmp

Filesize
120KB

Download