822de860acb794f17ab47e3003345eaff3eac743a6b601d14662d0d01270c1c7

Analysis

max time kernel
162s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:55

Target

822de860acb794f17ab47e3003345eaff3eac743a6b601d14662d0d01270c1c7.dll
Size

75KB
MD5

368c56806852c50c8f91093600a8a89a
SHA1

43f98d0375b48e1d48195da356d090647daddf75
SHA256

822de860acb794f17ab47e3003345eaff3eac743a6b601d14662d0d01270c1c7
SHA512

44268c966c6816570b5d77e2accff326cd31fc31c5411f37686dbadf90c79a9253b2c8f18a6ba8fde5e6c69c3b83144253ffacaf39e548c79f34cf2266af1bb0
SSDEEP

1536:oelpK6Bp3ctQHCMQM+YRpZhIR5nsl2hoRC1D39YbvWzD:oWK2pmQQMrpOssR3nD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3676 3500 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
3676	3500	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2508 wrote to memory of 3500	2508	regsvr32.exe	regsvr32.exe
PID 2508 wrote to memory of 3500	2508	regsvr32.exe	regsvr32.exe
PID 2508 wrote to memory of 3500	2508	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\822de860acb794f17ab47e3003345eaff3eac743a6b601d14662d0d01270c1c7.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\822de860acb794f17ab47e3003345eaff3eac743a6b601d14662d0d01270c1c7.dll
2⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 616
3⤵
- Program crash
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3500 -ip 3500
1⤵
PID:3632

memory/3500-132-0x0000000000000000-mapping.dmp

Download
memory/3500-133-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download