5370badd7e004d9a29640df79ac08ff57ba3e873f983585d570392cbb0141bdc

Analysis

max time kernel
153s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 06:40

Target

5370badd7e004d9a29640df79ac08ff57ba3e873f983585d570392cbb0141bdc.dll
Size

210KB
MD5

0122b14b68c4fed563ce1d72fe82021c
SHA1

676983f6d0fbfe0e7445bc0f34d27de77c2541c5
SHA256

5370badd7e004d9a29640df79ac08ff57ba3e873f983585d570392cbb0141bdc
SHA512

eb907f92392d1b34fe5f371d67778ccad1ceea698d59e2d6c12ed8c9446ba660cf494e26a81457ddb36cf97c852bdcf9e9af544628fc07dd4ae50c6019ce2126
SSDEEP

3072:yuhE6zRk4hNDCDkcwFLb/9CZtzLIq01wnkvYSg7dHLV/k3tZ9k82yrnd+2jWA:yuhhNDtrHMzgL1wk6BMtZ/2yAhA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4432	980	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 980	664	regsvr32.exe	82
PID 664 wrote to memory of 980	664	regsvr32.exe	82
PID 664 wrote to memory of 980	664	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5370badd7e004d9a29640df79ac08ff57ba3e873f983585d570392cbb0141bdc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5370badd7e004d9a29640df79ac08ff57ba3e873f983585d570392cbb0141bdc.dll
  2⤵
  PID:980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 596
    3⤵
    - Program crash
    PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 980 -ip 980
1⤵
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 980 -ip 980
1⤵
PID:4236