f1f0aedc4793cbdd4f30b687a242d0160c82f1d62083c6f07c3ed5ea21c5e323

Analysis

max time kernel
121s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 18:27

Target

f1f0aedc4793cbdd4f30b687a242d0160c82f1d62083c6f07c3ed5ea21c5e323.dll
Size

88KB
MD5

64cf2deba92a05cb3d70710ea307cdc0
SHA1

350f227b13bba05c96d2cf0d52eefd5237aa7e1f
SHA256

f1f0aedc4793cbdd4f30b687a242d0160c82f1d62083c6f07c3ed5ea21c5e323
SHA512

4080a7e23dc4141e6ea23d73e8194aace5176f00c16a9f7be4e032909bf2e1bea3b4db3dd92013f7dd03be799173099b0dc377a60427b77d32bb0ab428a60d2e
SSDEEP

1536:FL7+rfix7kI37Icx3A/W5WD8CYOLCGbjuZ4DtGvK1V2BueYd1Qb3230NMo2KMx/P:tKWxY80G3YsOLNCZ4YNue81mG3yqRP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4124	4992	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4992	4144	regsvr32.exe	82
PID 4144 wrote to memory of 4992	4144	regsvr32.exe	82
PID 4144 wrote to memory of 4992	4144	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f1f0aedc4793cbdd4f30b687a242d0160c82f1d62083c6f07c3ed5ea21c5e323.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f1f0aedc4793cbdd4f30b687a242d0160c82f1d62083c6f07c3ed5ea21c5e323.dll
  2⤵
  PID:4992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 596
    3⤵
    - Program crash
    PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4992 -ip 4992
1⤵
PID:1732

memory/4992-133-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download