e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452

Analysis

max time kernel
136s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 11:11

Target

e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
Size

120KB
MD5

629242bce7ed1b4514de65a45aa22ec2
SHA1

0ff110fac76aab7923aeaac8eb4991495678a8ff
SHA256

e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452
SHA512

4ea8bebe96ec43cb7691f6ccbf448b3415c7bbc9d2a4dbcdde7570351cda9a64a95d8339100972ee0c83d8389d8735c6b3297e15a10c4d8f0ad2f195f630d669
SSDEEP

1536:DoqWQ4AAp40cfnUkN2NxQVbtMXBXoyoOKNz78O:yxAN0mUdMMIP7n

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	2100	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 2100	888	regsvr32.exe	82
PID 888 wrote to memory of 2100	888	regsvr32.exe	82
PID 888 wrote to memory of 2100	888	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e11df6d68f14d80af085064c38dcb7d5439b5682f0079e4d2e69d88e9873a452.dll
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 636
    3⤵
    - Program crash
    PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2100 -ip 2100
1⤵
PID:5004

memory/2100-133-0x0000000000830000-0x000000000084E000-memory.dmp

Filesize
120KB

Download