83d2d62e642fdfaf1579ecf6007e9eed7c39c3a85fd78f9443619a60b159eaee

Analysis

max time kernel
178s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:33

Target

83d2d62e642fdfaf1579ecf6007e9eed7c39c3a85fd78f9443619a60b159eaee.dll
Size

210KB
MD5

38f3c0814b3238bbb31c6aea6fc46479
SHA1

ad90589c95c7912d764aefce5856bd5d8b24c707
SHA256

83d2d62e642fdfaf1579ecf6007e9eed7c39c3a85fd78f9443619a60b159eaee
SHA512

eec41d95286d052657a703ab4dd61094d0dcbec451246888591b78a62426304d2dde5b86411d76cec532b946531727701f13e9d0a2d1acbfa8bf733eb786c5f7
SSDEEP

3072:yuhE6zRk3hNDCDkcwFLb/9CZtzLIq01wnkvYSg7dHLV/k3tZ9k82yrnd+2jWA:yuhMNDtrHMzgL1wk6BMtZ/2yAhA

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4892 3428 WerFault.exe regsvr32.exe
4148 3428 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
4892	3428	WerFault.exe	regsvr32.exe
4148	3428	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4972 wrote to memory of 3428	4972	regsvr32.exe	regsvr32.exe
PID 4972 wrote to memory of 3428	4972	regsvr32.exe	regsvr32.exe
PID 4972 wrote to memory of 3428	4972	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\83d2d62e642fdfaf1579ecf6007e9eed7c39c3a85fd78f9443619a60b159eaee.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\83d2d62e642fdfaf1579ecf6007e9eed7c39c3a85fd78f9443619a60b159eaee.dll
2⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 596
3⤵
- Program crash
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 644
3⤵
- Program crash
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3428 -ip 3428
1⤵
PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3428 -ip 3428
1⤵
PID:2028