289b2014c8e53e2a350240de2fd147f7da4768dbfb1a930882a5cc8d130d31c4

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 05:28

Target

289b2014c8e53e2a350240de2fd147f7da4768dbfb1a930882a5cc8d130d31c4.dll
Size

52KB
MD5

cd7ece28be0f149c5e4300be9603e330
SHA1

c2c1c06b8dbcef2b835feaca52461e394aa18b48
SHA256

289b2014c8e53e2a350240de2fd147f7da4768dbfb1a930882a5cc8d130d31c4
SHA512

947d73102f964c4a25f2cbd75f16858893771a71991a824e642f0cb9520358965affd45ebda480332387e98b911746e63bfbe01cb9cfa3c3cd638c607084e3b8
SSDEEP

768:ci21pSRDOXkZGkjrx2jNeiKTHoZ81+IfSEPtMgrRcTIFXeo5XU1oxe:z218tBh4js8mtR0IFXez1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	1076	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1076	764	regsvr32.exe	81
PID 764 wrote to memory of 1076	764	regsvr32.exe	81
PID 764 wrote to memory of 1076	764	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\289b2014c8e53e2a350240de2fd147f7da4768dbfb1a930882a5cc8d130d31c4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\289b2014c8e53e2a350240de2fd147f7da4768dbfb1a930882a5cc8d130d31c4.dll
  2⤵
  PID:1076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 616
    3⤵
    - Program crash
    PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1076 -ip 1076
1⤵
PID:1664