fe78d0399bbee93a985216641252d9cf41558ad48a35fe2677fb96bf8f5667e2

Analysis

max time kernel
151s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 13:13

Target

fe78d0399bbee93a985216641252d9cf41558ad48a35fe2677fb96bf8f5667e2.dll
Size

194KB
MD5

022da4b6791ff204864438f0f4213ce2
SHA1

8f9bf9c1ff812aee7ecb4ab2d80d272446d141da
SHA256

fe78d0399bbee93a985216641252d9cf41558ad48a35fe2677fb96bf8f5667e2
SHA512

fdbd4cbc91c615ab0306c0d98cbb76e17810b3f1026f48087caa6cb551259dd57ca2f48aa4d8d583ca73f0cc06dec4a06e13a8d4f59a8fa059cf8cef39c66eaa
SSDEEP

3072:BrcMNHrLpnAGhqbbwK9cRKSE276k1ah1VjyJ0FGb0CMKCA21E9mXmHfFvy2BL:Br9NBnAGUbMK9rSN2k12yvGXm/Np

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5100	4768	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4768	4540	regsvr32.exe	80
PID 4540 wrote to memory of 4768	4540	regsvr32.exe	80
PID 4540 wrote to memory of 4768	4540	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fe78d0399bbee93a985216641252d9cf41558ad48a35fe2677fb96bf8f5667e2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\fe78d0399bbee93a985216641252d9cf41558ad48a35fe2677fb96bf8f5667e2.dll
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 620
    3⤵
    - Program crash
    PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4768 -ip 4768
1⤵
PID:3052