83d2d62e642fdfaf1579ecf6007e9eed7c39c3a85fd78f9443619a60b159eaee

Analysis

max time kernel
33s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:33

Target

83d2d62e642fdfaf1579ecf6007e9eed7c39c3a85fd78f9443619a60b159eaee.dll
Size

210KB
MD5

38f3c0814b3238bbb31c6aea6fc46479
SHA1

ad90589c95c7912d764aefce5856bd5d8b24c707
SHA256

83d2d62e642fdfaf1579ecf6007e9eed7c39c3a85fd78f9443619a60b159eaee
SHA512

eec41d95286d052657a703ab4dd61094d0dcbec451246888591b78a62426304d2dde5b86411d76cec532b946531727701f13e9d0a2d1acbfa8bf733eb786c5f7
SSDEEP

3072:yuhE6zRk3hNDCDkcwFLb/9CZtzLIq01wnkvYSg7dHLV/k3tZ9k82yrnd+2jWA:yuhMNDtrHMzgL1wk6BMtZ/2yAhA

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1176 1452 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
1176	1452	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 940 wrote to memory of 1452	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1452	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1452	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1452	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1452	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1452	940	regsvr32.exe	regsvr32.exe
PID 940 wrote to memory of 1452	940	regsvr32.exe	regsvr32.exe
PID 1452 wrote to memory of 1176	1452	regsvr32.exe	WerFault.exe
PID 1452 wrote to memory of 1176	1452	regsvr32.exe	WerFault.exe
PID 1452 wrote to memory of 1176	1452	regsvr32.exe	WerFault.exe
PID 1452 wrote to memory of 1176	1452	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\83d2d62e642fdfaf1579ecf6007e9eed7c39c3a85fd78f9443619a60b159eaee.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\83d2d62e642fdfaf1579ecf6007e9eed7c39c3a85fd78f9443619a60b159eaee.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 304
3⤵
- Program crash
PID:1176

memory/940-54-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

Filesize
8KB

Download
memory/1176-57-0x0000000000000000-mapping.dmp

Download
memory/1452-55-0x0000000000000000-mapping.dmp

Download
memory/1452-56-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download