b03d0eb3fd7046d1ff86b47b1b695d3639bc90bb51d1402ae4ab946a24ae02a6

Analysis

max time kernel
153s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 17:38

Target

b03d0eb3fd7046d1ff86b47b1b695d3639bc90bb51d1402ae4ab946a24ae02a6.dll
Size

43KB
MD5

820148079ffcda359e6788f73cae5d6d
SHA1

c1c7b122047cfc8972cb4d6bec862a71cc150461
SHA256

b03d0eb3fd7046d1ff86b47b1b695d3639bc90bb51d1402ae4ab946a24ae02a6
SHA512

022849decec260a668dc0c90b78ba6cf9a8ea2197270a71e82d8041796257c2f736d4af329c93a8dba808edf1833131b8d355f506f953aeb77b704af93937acf
SSDEEP

768:71OE96O8LSU/w+G/GjPjOCwf+EH6Rfc9cOffVlFozlI0VZxzSZKXsgXTJrU:oE964+jPjRwNH6Zc9c1KOZxzqKXvFI

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1240	4492	WerFault.exe	82
4952	4492	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4492	2552	regsvr32.exe	82
PID 2552 wrote to memory of 4492	2552	regsvr32.exe	82
PID 2552 wrote to memory of 4492	2552	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b03d0eb3fd7046d1ff86b47b1b695d3639bc90bb51d1402ae4ab946a24ae02a6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b03d0eb3fd7046d1ff86b47b1b695d3639bc90bb51d1402ae4ab946a24ae02a6.dll
  2⤵
  PID:4492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 668
    3⤵
    - Program crash
    PID:1240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 624
    3⤵
    - Program crash
    PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4492 -ip 4492
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4492 -ip 4492
1⤵
PID:4652

memory/4492-133-0x0000000063090000-0x00000000630DA000-memory.dmp

Filesize
296KB

Download