92031675934400856ad71f5107f4ecd51f32329706842730d4dbcb7346df6c5d

Analysis

max time kernel
118s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 04:49

Target

92031675934400856ad71f5107f4ecd51f32329706842730d4dbcb7346df6c5d.dll
Size

210KB
MD5

4f49250ecf5b0792e25160ce61522c40
SHA1

dd9f19c5b1820c81e803f9a21fc1038d305014b8
SHA256

92031675934400856ad71f5107f4ecd51f32329706842730d4dbcb7346df6c5d
SHA512

1fcf6d7fb7c1de0a63cdf28f57bd2bdc6838e60c5f6f6f11433794a019f46dfa8a1677ee718e9dce5b4862b9401385f45ebd7cc70daad40f4124c4017bad4c89
SSDEEP

6144:yuhYXs1/Eqj5UovHkyJqJBl5VtJYluAOx/:yuiy/tGofjgVlbP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
944	1220	WerFault.exe	81
4920	1220	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1220	4796	regsvr32.exe	81
PID 4796 wrote to memory of 1220	4796	regsvr32.exe	81
PID 4796 wrote to memory of 1220	4796	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\92031675934400856ad71f5107f4ecd51f32329706842730d4dbcb7346df6c5d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\92031675934400856ad71f5107f4ecd51f32329706842730d4dbcb7346df6c5d.dll
  2⤵
  PID:1220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 612
    3⤵
    - Program crash
    PID:944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 648
    3⤵
    - Program crash
    PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1220 -ip 1220
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1220 -ip 1220
1⤵
PID:1968