5f5e6819095d3873be477f929133dff062a1e755e2e1a5ac0ca8f54f93f62c03

Analysis

max time kernel
135s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:13

Target

5f5e6819095d3873be477f929133dff062a1e755e2e1a5ac0ca8f54f93f62c03.dll
Size

210KB
MD5

370e8bec237179c34e756770701087d3
SHA1

e43f165ac5c2227c2f562be85107e6caa2a95076
SHA256

5f5e6819095d3873be477f929133dff062a1e755e2e1a5ac0ca8f54f93f62c03
SHA512

16f28d87a2a1070bc35c7106e309542612c3ba44cca4b570290cb28964771220d847e5a6438ceca2a1000441536fbfa9233170630eb3f7dbb3fe73ced6756f40
SSDEEP

6144:yuhU22wUrh0p+J9cZtspaAwvl+ID6rhIhiuTm:yuaXwI0PZtEh6jWhJuTm

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

744 4700 WerFault.exe regsvr32.exe
2244 4700 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
744	4700	WerFault.exe	regsvr32.exe
2244	4700	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4348 wrote to memory of 4700	4348	regsvr32.exe	regsvr32.exe
PID 4348 wrote to memory of 4700	4348	regsvr32.exe	regsvr32.exe
PID 4348 wrote to memory of 4700	4348	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5f5e6819095d3873be477f929133dff062a1e755e2e1a5ac0ca8f54f93f62c03.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4348

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\5f5e6819095d3873be477f929133dff062a1e755e2e1a5ac0ca8f54f93f62c03.dll
2⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 596
3⤵
- Program crash
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 620
3⤵
- Program crash
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4700 -ip 4700
1⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4700 -ip 4700
1⤵
PID:4864