81d5fd23e26eca131eaf4748c44a6485f84827f7448e9833b3c8b8fd975fe5db

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 19:22

Target

81d5fd23e26eca131eaf4748c44a6485f84827f7448e9833b3c8b8fd975fe5db.dll
Size

157KB
MD5

73e166a5ad8b771cc3c8c135f84daa43
SHA1

850f1adc526bb835ca01ecd29462636e6a5d50a0
SHA256

81d5fd23e26eca131eaf4748c44a6485f84827f7448e9833b3c8b8fd975fe5db
SHA512

4a65a216caa7ebecc6eb4d7327571ba3fef5a91e0f15c2a998625c80f78ace081be15f4c91426490ed51f592f53a3a9d2a6ecd2f9443f7cbec6f6bc5ca1a54e6
SSDEEP

3072:GbLJEsAXBFa2MAnJuXT//TBf5cy3mO/ya:kFJAXBjJnJqT//TBxb3p/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4808 1296 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1296 regsvr32.exe
1296 regsvr32.exe

pid	pid_target	process	target process
4808	1296	WerFault.exe	regsvr32.exe

pid	process
1296	regsvr32.exe
1296	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4888 wrote to memory of 1296	4888	regsvr32.exe	regsvr32.exe
PID 4888 wrote to memory of 1296	4888	regsvr32.exe	regsvr32.exe
PID 4888 wrote to memory of 1296	4888	regsvr32.exe	regsvr32.exe
PID 1296 wrote to memory of 4624	1296	regsvr32.exe	wermgr.exe
PID 1296 wrote to memory of 4624	1296	regsvr32.exe	wermgr.exe
PID 1296 wrote to memory of 4624	1296	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\81d5fd23e26eca131eaf4748c44a6485f84827f7448e9833b3c8b8fd975fe5db.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 756
3⤵
- Program crash
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1296 -ip 1296
1⤵
PID:4048