e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452

Analysis

max time kernel
136s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 11:11

Target
e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
Size 120KB
Sample221003-nak9fadce4
SHA256 e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452
MD5 629242bce7ed1b4514de65a45aa22ec2
SHA1 0ff110fac76aab7923aeaac8eb4991495678a8ff
SHA512 4ea8bebe96ec43cb7691f6ccbf448b3415c7bbc9d2a4dbcdde7570351cda9a64a95d8339100972ee0c83d8389d8735c6b3297e15a10c4d8f0ad2f195f630d669
SSDEEP 1536:DoqWQ4AAp40cfnUkN2NxQVbtMXBXoyoOKNz78O:yxAN0mUdMMIP7n
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	2100	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 2100	888	regsvr32.exe	82
PID 888 wrote to memory of 2100	888	regsvr32.exe	82
PID 888 wrote to memory of 2100	888	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 636
    3⤵
    - Program crash
    PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2100 -ip 2100
1⤵
PID:5004

memory/2100-133-0x0000000000830000-0x000000000084E000-memory.dmp

Download