1ee5c674b64eee2406d7dc3620874459eaae6403cb05960bc6c7f05d7a33a067

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 19:53

Target

1ee5c674b64eee2406d7dc3620874459eaae6403cb05960bc6c7f05d7a33a067.dll
Size

159KB
MD5

a416dea53b3d6f72b6419b31a655b502
SHA1

7fa4236979a07771857f889810f733496f406b76
SHA256

1ee5c674b64eee2406d7dc3620874459eaae6403cb05960bc6c7f05d7a33a067
SHA512

25d91b138e47d34bfd1ec12b00d896ffa0dd74ed48f36ef5e7e19e8c345677fafd8a34f525bc1b0eafc13b43d29862f23038f319775503d6b6128671b81949e6
SSDEEP

3072:y4miIdmae/vV4cnux9LUAgJkCzkATBfZjva83FAO/ya:YmnHiOuxxBgJZzkATBRu83Fj/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1000 1284 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

regsvr32.exe

pid process

1284 regsvr32.exe

pid	pid_target	process	target process
1000	1284	WerFault.exe	regsvr32.exe

pid	process
1284	regsvr32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1720 wrote to memory of 1284	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1284	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1284	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1284	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1284	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1284	1720	regsvr32.exe	regsvr32.exe
PID 1720 wrote to memory of 1284	1720	regsvr32.exe	regsvr32.exe
PID 1284 wrote to memory of 1744	1284	regsvr32.exe	wermgr.exe
PID 1284 wrote to memory of 1744	1284	regsvr32.exe	wermgr.exe
PID 1284 wrote to memory of 1744	1284	regsvr32.exe	wermgr.exe
PID 1284 wrote to memory of 1744	1284	regsvr32.exe	wermgr.exe
PID 1284 wrote to memory of 1000	1284	regsvr32.exe	WerFault.exe
PID 1284 wrote to memory of 1000	1284	regsvr32.exe	WerFault.exe
PID 1284 wrote to memory of 1000	1284	regsvr32.exe	WerFault.exe
PID 1284 wrote to memory of 1000	1284	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1ee5c674b64eee2406d7dc3620874459eaae6403cb05960bc6c7f05d7a33a067.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1ee5c674b64eee2406d7dc3620874459eaae6403cb05960bc6c7f05d7a33a067.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 428
    3⤵
    - Program crash
    PID:1000

memory/1000-57-0x0000000000000000-mapping.dmp

Download
memory/1284-55-0x0000000000000000-mapping.dmp

Download
memory/1284-56-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1720-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download