ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 12:17

Target

ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll
Size

100KB
MD5

6e64b1199242a8eff3fa965ed48debc0
SHA1

3654d8c0df019c5d2239a1e318ef06ebc7bfcf8b
SHA256

ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b
SHA512

00fc9db62ec404f55a85bee124149a48d17c380dc4c0dfa9108a9d8c66014e2141c1007227c19cf954f7ae5c788947412c9301ffe3c76c64a8419e2c6bb069c1
SSDEEP

1536:0U/TEE5kmxI5QPS1rHCZO9XIx089oPnjNrxa1VQ4VuBk4hWaOH5YNak:bbEExxI5QqVV9ZPjxSGk44auYNb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4060	4312	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4312	2248	regsvr32.exe	83
PID 2248 wrote to memory of 4312	2248	regsvr32.exe	83
PID 2248 wrote to memory of 4312	2248	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ca91daa1437a8cd7c349d600def5ea8feb540ebd665c2e354e460c2b6d64ad4b.dll
  2⤵
  PID:4312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 616
    3⤵
    - Program crash
    PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4312 -ip 4312
1⤵
PID:3556

memory/4312-133-0x00000000022E0000-0x0000000002327000-memory.dmp

Filesize
284KB

Download