5a6f3f8a7159d9ef9c14f8e01b19e9ce6de354b9e12a984460aedac9924bef3b

Analysis

max time kernel
169s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 20:48

Target

5a6f3f8a7159d9ef9c14f8e01b19e9ce6de354b9e12a984460aedac9924bef3b.dll
Size

132KB
MD5

74dea25e27ad10e064132906f41d2290
SHA1

f926248b24c530a252c912d204b69c7ee6fe85ec
SHA256

5a6f3f8a7159d9ef9c14f8e01b19e9ce6de354b9e12a984460aedac9924bef3b
SHA512

bd85d6737f3e9d0d6564ddb30964cd284d3df5b14a4b22ac1365ccb9bd770da019886e2cac322e3c186d6d057694d290d732d87dd8e44b4581fea70c3719f507
SSDEEP

1536:+0MqqppQ+WQzYA2Yl8wNqfzIWpbdGtGU12zhv48:7SOyV28fKz+g42NvZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	2028	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2028	812	regsvr32.exe	84
PID 812 wrote to memory of 2028	812	regsvr32.exe	84
PID 812 wrote to memory of 2028	812	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5a6f3f8a7159d9ef9c14f8e01b19e9ce6de354b9e12a984460aedac9924bef3b.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5a6f3f8a7159d9ef9c14f8e01b19e9ce6de354b9e12a984460aedac9924bef3b.dll
  2⤵
  PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 668
    3⤵
    - Program crash
    PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2028 -ip 2028
1⤵
PID:2220

memory/2028-132-0x0000000000000000-mapping.dmp

Download
memory/2028-133-0x00000000007C0000-0x00000000007E1000-memory.dmp

Filesize
132KB

Download