db546476aba3fa5b9227fd5ff684e804851aa0baf5fe18962bb8bc8794dacaa0

Analysis

max time kernel
34s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:39

Target

db546476aba3fa5b9227fd5ff684e804851aa0baf5fe18962bb8bc8794dacaa0.dll
Size

141KB
MD5

0952020a3d85d8f58434c0cd73d97690
SHA1

2f9a1ed3c221055c561a5827144fed6531df3845
SHA256

db546476aba3fa5b9227fd5ff684e804851aa0baf5fe18962bb8bc8794dacaa0
SHA512

e69424c9302eecc75c1445fa43d77e1fcbe3e87962915e62e66df6d370086c75075fd2f3c01bbe80c3af7a71cd7ab5249f3fed3e3cb2b2be92ac7f81febfe492
SSDEEP

1536:HG/w8HEhSpC6zRk5H5fjvHOhNRsyHB0syhlCPVUfUzvP0CzqMpqERwxV1uKtCLDP:HuhE6zRkbzcd2lCdaUrcIzhNQHt+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	1560	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1560	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1560	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1560	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1560	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1560	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1560	1628	regsvr32.exe	27
PID 1628 wrote to memory of 1560	1628	regsvr32.exe	27
PID 1560 wrote to memory of 1952	1560	regsvr32.exe	28
PID 1560 wrote to memory of 1952	1560	regsvr32.exe	28
PID 1560 wrote to memory of 1952	1560	regsvr32.exe	28
PID 1560 wrote to memory of 1952	1560	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\db546476aba3fa5b9227fd5ff684e804851aa0baf5fe18962bb8bc8794dacaa0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\db546476aba3fa5b9227fd5ff684e804851aa0baf5fe18962bb8bc8794dacaa0.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 304
    3⤵
    - Program crash
    PID:1952

memory/1560-56-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1628-54-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download