90154946be4de7c77b0dbc678188f71801cf6803a9acf6acd65f526f63ec9076

Analysis

max time kernel
199s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 12:41

Target

90154946be4de7c77b0dbc678188f71801cf6803a9acf6acd65f526f63ec9076.dll
Size

116KB
MD5

39353fe9b59f483d3a38c578f0dd3380
SHA1

9f6fe225ab7b75f954096ce25e684e5ab04271d4
SHA256

90154946be4de7c77b0dbc678188f71801cf6803a9acf6acd65f526f63ec9076
SHA512

13243cc215526127ee670141454ac955ccb4336d594d5ad14b34d8d6a71ea778e2690bcc6f467e852173125ae346e5a6521a25679e42a7f28f3294bc6968343e
SSDEEP

768:9oiRqZO5QGSEoHMJ55y8ACpbIgfH/YRC3z1K9elx16xyRB1eacTLLyojOleN0GLu:9vRqZkQjekoi6dHo0RRQXNbK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3304	1060	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1060	2780	regsvr32.exe	80
PID 2780 wrote to memory of 1060	2780	regsvr32.exe	80
PID 2780 wrote to memory of 1060	2780	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\90154946be4de7c77b0dbc678188f71801cf6803a9acf6acd65f526f63ec9076.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\90154946be4de7c77b0dbc678188f71801cf6803a9acf6acd65f526f63ec9076.dll
  2⤵
  PID:1060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 644
    3⤵
    - Program crash
    PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1060 -ip 1060
1⤵
PID:2876

memory/1060-133-0x00000000006A0000-0x00000000006BD000-memory.dmp

Filesize
116KB

Download