cb86e32df5c5bb6d3f8092a3e934a65227025c7d6026ba97d9265c6f4b8cef7e

Analysis

max time kernel
2s
max time network
66s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 20:21

Target

cb86e32df5c5bb6d3f8092a3e934a65227025c7d6026ba97d9265c6f4b8cef7e.dll
Size

210KB
MD5

1949a52da0ad0b823cee6aa9de2ec050
SHA1

547005686d6ae2e5c5a860146c3240ed2b599bf9
SHA256

cb86e32df5c5bb6d3f8092a3e934a65227025c7d6026ba97d9265c6f4b8cef7e
SHA512

046dce13583a4ea691dfa1f579ab270cfecd8122fd64bb8f0f14e20566588ddfd1c5b427943d3bf49b2e05b3009d4446b7b389cd90680aee3df5370f3739a7db
SSDEEP

6144:yuhH22wUrh0p+J9cZtspaAwvl+ID6rhIhiuTm:yu9XwI0PZtEh6jWhJuTm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
240	1528	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1528	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1528	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1528	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1528	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1528	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1528	2036	regsvr32.exe	28
PID 2036 wrote to memory of 1528	2036	regsvr32.exe	28
PID 1528 wrote to memory of 240	1528	regsvr32.exe	29
PID 1528 wrote to memory of 240	1528	regsvr32.exe	29
PID 1528 wrote to memory of 240	1528	regsvr32.exe	29
PID 1528 wrote to memory of 240	1528	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cb86e32df5c5bb6d3f8092a3e934a65227025c7d6026ba97d9265c6f4b8cef7e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cb86e32df5c5bb6d3f8092a3e934a65227025c7d6026ba97d9265c6f4b8cef7e.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 304
    3⤵
    - Program crash
    PID:240

memory/240-57-0x0000000000000000-mapping.dmp

Download
memory/1528-55-0x0000000000000000-mapping.dmp

Download
memory/1528-56-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/2036-54-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download