922addae4cba0be3fc3df6542613a7c2e3c8f645c02360e0d6168e31a0becd76

Analysis

max time kernel
87s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 07:03

Target

922addae4cba0be3fc3df6542613a7c2e3c8f645c02360e0d6168e31a0becd76.dll
Size

19KB
MD5

76cc019de3d6585dcffed113d4504df8
SHA1

6c067ba93de7abc0f988cd1788d11f87a0748f44
SHA256

922addae4cba0be3fc3df6542613a7c2e3c8f645c02360e0d6168e31a0becd76
SHA512

d6010160374974994bbbbc041f164739610e9ae216c18662bf26f8d6d38ab0a50cad35b4b8b6e90f2d71f721e985a7505908ef508d64d3c52b09e332c863a2ed
SSDEEP

384:8TKir1i/8WaBn6igjVJGBoe4p2lQb5fx69HOZFCV4W6:OKig//CWJGBxXebn69ujbW6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	3796	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 3796	1756	regsvr32.exe	85
PID 1756 wrote to memory of 3796	1756	regsvr32.exe	85
PID 1756 wrote to memory of 3796	1756	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\922addae4cba0be3fc3df6542613a7c2e3c8f645c02360e0d6168e31a0becd76.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\922addae4cba0be3fc3df6542613a7c2e3c8f645c02360e0d6168e31a0becd76.dll
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 672
    3⤵
    - Program crash
    PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3796 -ip 3796
1⤵
PID:536

memory/3796-133-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download