bda559bcf350d24b9ecc3168a6fa606f6bbaa7f0db17f0edf877de6f3edbc0fe

Analysis

max time kernel
256s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 11:22

Target

bda559bcf350d24b9ecc3168a6fa606f6bbaa7f0db17f0edf877de6f3edbc0fe.dll
Size

216KB
MD5

923baa30e30d22ed4ac2d24e7045d9e4
SHA1

9aa3ae004ad9e1ebea83db8239b19b3740a7a8e0
SHA256

bda559bcf350d24b9ecc3168a6fa606f6bbaa7f0db17f0edf877de6f3edbc0fe
SHA512

c403e6a820305e2bbfa77a0baf154aa5e6a59fc81e08862a44e67e4f968e4bbc9c375b4276d10bd2a9928dba9483d9d170101d6cb5828791d05d4f74aca3f9ff
SSDEEP

6144:RkqUOG//d8E/iVtu/32B5GsBoimtQSbjrcac:KqUOG//d8E/cIk5GsBwQUjrcac

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	4128	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 4128	3768	regsvr32.exe	81
PID 3768 wrote to memory of 4128	3768	regsvr32.exe	81
PID 3768 wrote to memory of 4128	3768	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bda559bcf350d24b9ecc3168a6fa606f6bbaa7f0db17f0edf877de6f3edbc0fe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bda559bcf350d24b9ecc3168a6fa606f6bbaa7f0db17f0edf877de6f3edbc0fe.dll
  2⤵
  PID:4128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 620
    3⤵
    - Program crash
    PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4128 -ip 4128
1⤵
PID:992

memory/4128-132-0x0000000000000000-mapping.dmp

Download
memory/4128-133-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download