86376681ac5212180d3fa2c2dba2131a4f9bdb2af5ec3299919cde3f67e7410e

Analysis

max time kernel
152s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 12:58

Target

86376681ac5212180d3fa2c2dba2131a4f9bdb2af5ec3299919cde3f67e7410e.dll
Size

72KB
MD5

7d23743ea756da22d24153413d2408ae
SHA1

4361fd71a71f319cc54ae63c0df859800879ab33
SHA256

86376681ac5212180d3fa2c2dba2131a4f9bdb2af5ec3299919cde3f67e7410e
SHA512

a569dee2c22dbcd21ccd69ea822574b88675d02312ec51c3aefe87e970ab752239d6ca9269fd381237b73124772bad5a89b6d27b8480f59326c2039f47498521
SSDEEP

768:nxbiRs43ImYY2uXZ9hAVaAAStKIZ+2fJcwqVETAz4HMBbsjubRGPZMoJdc:OsjY2IGI7IZ+nVETAzFsu9foJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4132	2592	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2592	2232	regsvr32.exe	81
PID 2232 wrote to memory of 2592	2232	regsvr32.exe	81
PID 2232 wrote to memory of 2592	2232	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\86376681ac5212180d3fa2c2dba2131a4f9bdb2af5ec3299919cde3f67e7410e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\86376681ac5212180d3fa2c2dba2131a4f9bdb2af5ec3299919cde3f67e7410e.dll
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 620
    3⤵
    - Program crash
    PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2592 -ip 2592
1⤵
PID:4136

memory/2592-133-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download