457c61657b0048c3b5f0793f4d63cbdfe83ccfb9ffc81cc0b805e76fcafea7f4

Analysis

max time kernel
111s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 12:20

Target

457c61657b0048c3b5f0793f4d63cbdfe83ccfb9ffc81cc0b805e76fcafea7f4.dll
Size

167KB
MD5

69aed05c36d7406585c0311524814460
SHA1

c0f23102b0dad9f2023ffbed0e91308c0bc356cf
SHA256

457c61657b0048c3b5f0793f4d63cbdfe83ccfb9ffc81cc0b805e76fcafea7f4
SHA512

2c0c47b0eb0e47461946cc3e5baee8b6e17b946cb6db09bcfa3419e7bb2d010771bc843ccc2bbbd429d7f10c3c0b8f51b832eee7b1dc9bed69ef88f22c63dff3
SSDEEP

1536:EtUQzlcEl/WTylK1ML23bNLylol7LVpgKCzmYTThYfcB+B40R5:EtU8ll9yy+xLV6KCzPhY00S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4724	4212	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4212	4168	regsvr32.exe	82
PID 4168 wrote to memory of 4212	4168	regsvr32.exe	82
PID 4168 wrote to memory of 4212	4168	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\457c61657b0048c3b5f0793f4d63cbdfe83ccfb9ffc81cc0b805e76fcafea7f4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\457c61657b0048c3b5f0793f4d63cbdfe83ccfb9ffc81cc0b805e76fcafea7f4.dll
  2⤵
  PID:4212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 596
    3⤵
    - Program crash
    PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4212 -ip 4212
1⤵
PID:364

memory/4212-133-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download