fc997a0d74a2e38f4b212e12e49ca2b9aa786e6db96a6eaa35b9e40a0ad0e117

Analysis

max time kernel
139s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 07:28

Target

fc997a0d74a2e38f4b212e12e49ca2b9aa786e6db96a6eaa35b9e40a0ad0e117.dll
Size

128KB
MD5

351e5ce99406e8fb168fbea69157bc92
SHA1

2578d29eb111799037f3a7a3fe0c288342e80d23
SHA256

fc997a0d74a2e38f4b212e12e49ca2b9aa786e6db96a6eaa35b9e40a0ad0e117
SHA512

abbf8bb9b2439b487710a1286490424377ac59b64c6e858ad486af4b031351f1398c3787c3ca084ca7f6fe7ee4996c244d0ae6094d75c7d09f7436514ae13aef
SSDEEP

3072:qKpe7YuckOho4Bv3H1sG0HAEJmgEBkPRGC51zjTKS26ddG:qKpYYjdXyRmgRGC/ziSXdc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1244	1760	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 1760	4964	regsvr32.exe	80
PID 4964 wrote to memory of 1760	4964	regsvr32.exe	80
PID 4964 wrote to memory of 1760	4964	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fc997a0d74a2e38f4b212e12e49ca2b9aa786e6db96a6eaa35b9e40a0ad0e117.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fc997a0d74a2e38f4b212e12e49ca2b9aa786e6db96a6eaa35b9e40a0ad0e117.dll
  2⤵
  PID:1760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 588
    3⤵
    - Program crash
    PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1760 -ip 1760
1⤵
PID:4272

memory/1760-133-0x0000000010000000-0x0000000010083000-memory.dmp

Filesize
524KB

Download