71fbfb1f45574e329bb088b6dbd88d3515595b83feae55f9b617bda31b9032de

Analysis

max time kernel
91s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 04:33

Target

71fbfb1f45574e329bb088b6dbd88d3515595b83feae55f9b617bda31b9032de.dll
Size

120KB
MD5

3fa7c20d918a56a869124b7333f91ca9
SHA1

5de6d15516c06f0d4f910c9238a994837333e2e1
SHA256

71fbfb1f45574e329bb088b6dbd88d3515595b83feae55f9b617bda31b9032de
SHA512

cff00aa2abeba3b17063056ade5e4a9b3a98e5a3aaaea2022d21d45c84204eb3f43c9ad47c0a53c93e0b885fbd94fd8acd13d42418975be9cc3fe25270d7b2ae
SSDEEP

768:K5tayhq4QC+IcV4bbVPt8+5bKi5OZvdczmwwR8sWLN45YmvOHuZjdAWwCSXBJeUS:uhq4Qcemp3z5OZL8F45TOShAuSxJe3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	5012	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 5012	4864	regsvr32.exe	25
PID 4864 wrote to memory of 5012	4864	regsvr32.exe	25
PID 4864 wrote to memory of 5012	4864	regsvr32.exe	25

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\71fbfb1f45574e329bb088b6dbd88d3515595b83feae55f9b617bda31b9032de.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\71fbfb1f45574e329bb088b6dbd88d3515595b83feae55f9b617bda31b9032de.dll
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 644
    3⤵
    - Program crash
    PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5012 -ip 5012
1⤵
PID:4104

memory/5012-133-0x00000000003A0000-0x00000000003BE000-memory.dmp

Filesize
120KB

Download