89da48a7276109cdb34d89aa7ba8ea14d66d6d3dd8807a8bf0168f1bf6d0ad43

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 06:46

Target

89da48a7276109cdb34d89aa7ba8ea14d66d6d3dd8807a8bf0168f1bf6d0ad43.dll
Size

575KB
MD5

51af967a6f22badfdb2d1ba6498303f0
SHA1

2a01bf878f0e6334eb8848e31bfd175d6d0677ab
SHA256

89da48a7276109cdb34d89aa7ba8ea14d66d6d3dd8807a8bf0168f1bf6d0ad43
SHA512

b90e7ddf547b0276dbbc94b44d0044e9d2a1852d7f2f451c63c10e5cd2db87708d514eb8d33f6be195e5b21eb34746fb117f394e9dee999a8628775b55bc9e6d
SSDEEP

6144:SJ+KmjNZP5vuY90aBBeZRAiulbQOuzq2ePOrR5k3WO:5LjNtl0iBeLuBYzpewk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1168	1352	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1352	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1352	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1352	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1352	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1352	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1352	1600	regsvr32.exe	27
PID 1600 wrote to memory of 1352	1600	regsvr32.exe	27
PID 1352 wrote to memory of 1168	1352	regsvr32.exe	28
PID 1352 wrote to memory of 1168	1352	regsvr32.exe	28
PID 1352 wrote to memory of 1168	1352	regsvr32.exe	28
PID 1352 wrote to memory of 1168	1352	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\89da48a7276109cdb34d89aa7ba8ea14d66d6d3dd8807a8bf0168f1bf6d0ad43.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\89da48a7276109cdb34d89aa7ba8ea14d66d6d3dd8807a8bf0168f1bf6d0ad43.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 300
    3⤵
    - Program crash
    PID:1168

memory/1352-56-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1352-58-0x000000004BDE0000-0x000000004BE7A000-memory.dmp

Filesize
616KB

Download
memory/1600-54-0x000007FEFB781000-0x000007FEFB783000-memory.dmp

Filesize
8KB

Download