1ee5c674b64eee2406d7dc3620874459eaae6403cb05960bc6c7f05d7a33a067

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2022 19:53

Target

1ee5c674b64eee2406d7dc3620874459eaae6403cb05960bc6c7f05d7a33a067.dll
Size

159KB
MD5

a416dea53b3d6f72b6419b31a655b502
SHA1

7fa4236979a07771857f889810f733496f406b76
SHA256

1ee5c674b64eee2406d7dc3620874459eaae6403cb05960bc6c7f05d7a33a067
SHA512

25d91b138e47d34bfd1ec12b00d896ffa0dd74ed48f36ef5e7e19e8c345677fafd8a34f525bc1b0eafc13b43d29862f23038f319775503d6b6128671b81949e6
SSDEEP

3072:y4miIdmae/vV4cnux9LUAgJkCzkATBfZjva83FAO/ya:YmnHiOuxxBgJZzkATBRu83Fj/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4632 4440 WerFault.exe regsvr32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4440 regsvr32.exe
4440 regsvr32.exe

pid	pid_target	process	target process
4632	4440	WerFault.exe	regsvr32.exe

pid	process
4440	regsvr32.exe
4440	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 4796 wrote to memory of 4440	4796	regsvr32.exe	regsvr32.exe
PID 4796 wrote to memory of 4440	4796	regsvr32.exe	regsvr32.exe
PID 4796 wrote to memory of 4440	4796	regsvr32.exe	regsvr32.exe
PID 4440 wrote to memory of 4660	4440	regsvr32.exe	wermgr.exe
PID 4440 wrote to memory of 4660	4440	regsvr32.exe	wermgr.exe
PID 4440 wrote to memory of 4660	4440	regsvr32.exe	wermgr.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1ee5c674b64eee2406d7dc3620874459eaae6403cb05960bc6c7f05d7a33a067.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1ee5c674b64eee2406d7dc3620874459eaae6403cb05960bc6c7f05d7a33a067.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\wermgr.exe
    C:\Windows\SysWOW64\wermgr.exe
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 752
    3⤵
    - Program crash
    PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4440 -ip 4440
1⤵
PID:4392