7749ef4fb37741d4dc880c0789ef0a99692ab2af300137e82cac53d483abb63b

Analysis

max time kernel
90s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 20:21

Target

7749ef4fb37741d4dc880c0789ef0a99692ab2af300137e82cac53d483abb63b.dll
Size

216KB
MD5

05b468b8dd0326e7a7e76a718b531c2b
SHA1

87b379833852c12ee37a28765a74be6a8a0e40e5
SHA256

7749ef4fb37741d4dc880c0789ef0a99692ab2af300137e82cac53d483abb63b
SHA512

ded06fb369bf1f01a7e934bce19187bfa30085d91a6a1ddb34fd8a9340d30a4a9414c20a1870f6038c0493b9954a787b11f137a963abf3d7ec3c2596ebee576d
SSDEEP

3072:QfXh51BeHnqdz7CNRF7YI1icLdef8ap/BtzcithwsPhk8I0x+Xx46OmPmdv7DYY3:qveH4CNnh1XLda5tgghhkMoXiBv/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2384	640	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 640	1232	regsvr32.exe	81
PID 1232 wrote to memory of 640	1232	regsvr32.exe	81
PID 1232 wrote to memory of 640	1232	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7749ef4fb37741d4dc880c0789ef0a99692ab2af300137e82cac53d483abb63b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\7749ef4fb37741d4dc880c0789ef0a99692ab2af300137e82cac53d483abb63b.dll
  2⤵
  PID:640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 660
    3⤵
    - Program crash
    PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 640 -ip 640
1⤵
PID:1420