f82750845b0abd85ee53e83da591da4252ff17fd92d06289f6e55c25a934c220

Analysis

max time kernel
161s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 03:52

Target

f82750845b0abd85ee53e83da591da4252ff17fd92d06289f6e55c25a934c220.dll
Size

170KB
MD5

0691f60ce68b1a87b0eee4384dee29b2
SHA1

8f0052a3452a96db6ee028bfc664750ee572f9a4
SHA256

f82750845b0abd85ee53e83da591da4252ff17fd92d06289f6e55c25a934c220
SHA512

ae84f9dbab7393c484d250feb0842c64d778c865637adc135e4b9223486a174309ac588e05177822c1f34171a3f87dd1974cc21b1053488f261faacaefc5547f
SSDEEP

3072:eUXlFI6KJyss2qQwPyEKM3yCFWPusDBdR8ZdCzH/SxwsK1kN22B3szwk1:eMXI68yNqSx3yC8PVDBdRaCzH/Sxwn1D

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4816	4336	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4336	4132	regsvr32.exe	79
PID 4132 wrote to memory of 4336	4132	regsvr32.exe	79
PID 4132 wrote to memory of 4336	4132	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f82750845b0abd85ee53e83da591da4252ff17fd92d06289f6e55c25a934c220.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f82750845b0abd85ee53e83da591da4252ff17fd92d06289f6e55c25a934c220.dll
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 628
    3⤵
    - Program crash
    PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4336 -ip 4336
1⤵
PID:508