21f9a66ef042bde5d2dc2f9ca75e5e7090369f89da678feb72262ea7e5a57120

Analysis

max time kernel
223s
max time network
243s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:03

Target

21f9a66ef042bde5d2dc2f9ca75e5e7090369f89da678feb72262ea7e5a57120.dll
Size

170KB
MD5

2ccf3cb208f18b56e9a52ba73df6df43
SHA1

3c8555c0fd682734027d844336fdb3feaf72061a
SHA256

21f9a66ef042bde5d2dc2f9ca75e5e7090369f89da678feb72262ea7e5a57120
SHA512

d8ec3a4a0fe903ac87f928b2468e995c48d0f110e0c8914cd776ba89d6aa99086a7ff315a86a14291778809e6f1e8265916738ffeba37102bd0be60770b411e9
SSDEEP

3072:eUXlFI6KSyss2qQwPyEKM3yCFWPusDBdR8ZdCzH/SxwsK1kN22B3szwk1:eMXI6byNqSx3yC8PVDBdRaCzH/Sxwn1D

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2968 2632 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
2968	2632	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4616 wrote to memory of 2632	4616	regsvr32.exe	regsvr32.exe
PID 4616 wrote to memory of 2632	4616	regsvr32.exe	regsvr32.exe
PID 4616 wrote to memory of 2632	4616	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\21f9a66ef042bde5d2dc2f9ca75e5e7090369f89da678feb72262ea7e5a57120.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4616

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\21f9a66ef042bde5d2dc2f9ca75e5e7090369f89da678feb72262ea7e5a57120.dll
2⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 636
3⤵
- Program crash
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2632 -ip 2632
1⤵
PID:3936