dbb7d11f1180d2fa8d380cf6ee2dbe524143e37e33f6a31c5be9acd627963bc5

Analysis

max time kernel
171s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:26

Target

dbb7d11f1180d2fa8d380cf6ee2dbe524143e37e33f6a31c5be9acd627963bc5.dll
Size

212KB
MD5

52a52b0fd892c8d9ccdd33e47e091c9e
SHA1

2bf4738062526b29a71ec9296e7e7f0cb9c91b39
SHA256

dbb7d11f1180d2fa8d380cf6ee2dbe524143e37e33f6a31c5be9acd627963bc5
SHA512

2fe9978828446bd372cabdb3db71070456344f9d68be09e737d33c3b3738275bc9961c8b230216f2910a5b2ab9062cebaaa0e02a75881be8a40eca077058b27b
SSDEEP

3072:MCDNiFpr2ESLfCuJ4KUsC0F1sVHrgu14syRryvQvsAG1Rt+iJ:19La1sCksVLgu6RyvQUAH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2400 2076 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
2400	2076	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4844 wrote to memory of 2076	4844	regsvr32.exe	regsvr32.exe
PID 4844 wrote to memory of 2076	4844	regsvr32.exe	regsvr32.exe
PID 4844 wrote to memory of 2076	4844	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dbb7d11f1180d2fa8d380cf6ee2dbe524143e37e33f6a31c5be9acd627963bc5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\dbb7d11f1180d2fa8d380cf6ee2dbe524143e37e33f6a31c5be9acd627963bc5.dll
2⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 628
3⤵
- Program crash
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2076 -ip 2076
1⤵
PID:4436