4d5db05e3f12e5e0c69f79f281bd4f36397b3594d6b86c1daf13d18bc4942798

Analysis

max time kernel
11s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:47

Target

4d5db05e3f12e5e0c69f79f281bd4f36397b3594d6b86c1daf13d18bc4942798.dll
Size

1.0MB
MD5

ab1fd76bdf1459d65e348a90a94172bd
SHA1

71b41850e2a1551f81a05ff9d541c800fe802cb7
SHA256

4d5db05e3f12e5e0c69f79f281bd4f36397b3594d6b86c1daf13d18bc4942798
SHA512

08b1b13fe38ffb467707c742ac659f58f16e6a7e85955f030e090876675792bb658504d7db1190e93216f585f345a3e6b4df77aee551a0d347bb0ad2cd857902
SSDEEP

24576:Q6dxy2HFvG7gjAgcSNvm/X+0MeGcQkREzFzMZxnN/:Q6d/l5hU0pYZpN/

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

852 1384 WerFault.exe regsvr32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

regsvr32.exe

pid process

1384 regsvr32.exe
1384 regsvr32.exe

pid	pid_target	process	target process
852	1384	WerFault.exe	regsvr32.exe

pid	process
1384	regsvr32.exe
1384	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 820 wrote to memory of 1384	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 1384	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 1384	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 1384	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 1384	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 1384	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 1384	820	regsvr32.exe	regsvr32.exe
PID 1384 wrote to memory of 852	1384	regsvr32.exe	WerFault.exe
PID 1384 wrote to memory of 852	1384	regsvr32.exe	WerFault.exe
PID 1384 wrote to memory of 852	1384	regsvr32.exe	WerFault.exe
PID 1384 wrote to memory of 852	1384	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4d5db05e3f12e5e0c69f79f281bd4f36397b3594d6b86c1daf13d18bc4942798.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 424
3⤵
- Program crash
PID:852

memory/820-54-0x000007FEFB8F1000-0x000007FEFB8F3000-memory.dmp

Filesize
8KB

Download
memory/852-58-0x0000000000000000-mapping.dmp

Download
memory/1384-55-0x0000000000000000-mapping.dmp

Download
memory/1384-56-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1384-57-0x0000000000A01000-0x0000000000AEB000-memory.dmp

Filesize
936KB

Download