06cb8f92d63bfea8e8ead5c61842d78706c60551d8f1c9dfca586013b2a93646

Analysis

max time kernel
146s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 19:18

Target

06cb8f92d63bfea8e8ead5c61842d78706c60551d8f1c9dfca586013b2a93646.dll
Size

85KB
MD5

0e51b329c22495e855e5311039dcd560
SHA1

2b25ed104e26cdd18a593ce4951c14ba25425fb4
SHA256

06cb8f92d63bfea8e8ead5c61842d78706c60551d8f1c9dfca586013b2a93646
SHA512

0c2dfdc87389581cc121ddd461f8416cbef2bea71183a2f05394542dcc942c8699b527193d903c5eddf5298cbbd55a8dfe0b18fea338340801538e55c4367af8
SSDEEP

1536:U4yyoTcP2Hh8/RU3rA1vpHGqJrwHwzFNIQ0NOSE8Hhd6mcbcccPfVZ:Uca6S0vR7BmA/4/4ofD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4980	4580	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 4580	4048	regsvr32.exe	82
PID 4048 wrote to memory of 4580	4048	regsvr32.exe	82
PID 4048 wrote to memory of 4580	4048	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\06cb8f92d63bfea8e8ead5c61842d78706c60551d8f1c9dfca586013b2a93646.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\06cb8f92d63bfea8e8ead5c61842d78706c60551d8f1c9dfca586013b2a93646.dll
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 604
    3⤵
    - Program crash
    PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4580 -ip 4580
1⤵
PID:3052

memory/4580-133-0x0000000010000000-0x0000000010074000-memory.dmp

Filesize
464KB

Download