e953f1565829ce0fb5a20847dcb103bead0cd95df9f5c2940930225749cf2d2a

Analysis

max time kernel
124s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 05:45

Target

e953f1565829ce0fb5a20847dcb103bead0cd95df9f5c2940930225749cf2d2a.dll
Size

111KB
MD5

6c3f131ba1c710f2daeefa687168edb5
SHA1

3940c4deabb3b4381ef856726e628c156f1b52d0
SHA256

e953f1565829ce0fb5a20847dcb103bead0cd95df9f5c2940930225749cf2d2a
SHA512

ffbe404ab353b3540f07de206b57836edafdcc350618f22a75912f278c85cae7afdd60942120ee61decf64f337cc59416cd3aa68850e4348f8ade2ef773f9c26
SSDEEP

3072:JWStEIIcue4C/CefzWdC59Fda/82N2pBXcyXyfdERk:JzDFuenzfadC5/cf2ptcyK0k

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2532	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 2532	3556	regsvr32.exe	83
PID 3556 wrote to memory of 2532	3556	regsvr32.exe	83
PID 3556 wrote to memory of 2532	3556	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e953f1565829ce0fb5a20847dcb103bead0cd95df9f5c2940930225749cf2d2a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e953f1565829ce0fb5a20847dcb103bead0cd95df9f5c2940930225749cf2d2a.dll
  2⤵
  PID:2532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 596
    3⤵
    - Program crash
    PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2532 -ip 2532
1⤵
PID:1504

memory/2532-133-0x0000000010000000-0x000000001008A000-memory.dmp

Filesize
552KB

Download