bb98d0c97704160b15ab50a1046e2f11e3765ffbbf68049f36c90b67f82e7719

Analysis

max time kernel
92s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:23

Target

bb98d0c97704160b15ab50a1046e2f11e3765ffbbf68049f36c90b67f82e7719.dll
Size

196KB
MD5

31a18c8078af716ec4ca889890eceb7d
SHA1

93337a9e130684f55240651be5869e5fd99ba17f
SHA256

bb98d0c97704160b15ab50a1046e2f11e3765ffbbf68049f36c90b67f82e7719
SHA512

456f8267ca097f6306e0289b313383c9d0976073b53d47714fe766d983c369e68e080a862487ca0a65d574752fdf757b3267457b877eeaec477815d5e3ba5ec9
SSDEEP

3072:/mMPtnODbUdIMn5EDzX1lH70V/5VhKzT9sVAlNCOfn9eEFRbYnMU:OMPYQ52XH70V/5VwLNTnYn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4936 4952 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
4936	4952	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2780 wrote to memory of 4952	2780	regsvr32.exe	regsvr32.exe
PID 2780 wrote to memory of 4952	2780	regsvr32.exe	regsvr32.exe
PID 2780 wrote to memory of 4952	2780	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bb98d0c97704160b15ab50a1046e2f11e3765ffbbf68049f36c90b67f82e7719.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\bb98d0c97704160b15ab50a1046e2f11e3765ffbbf68049f36c90b67f82e7719.dll
2⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 676
3⤵
- Program crash
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4952 -ip 4952
1⤵
PID:4852