d3eff497fd82747a674ea1e3b87a1251edac3f60b5e013172a9daf2a89060acc

Analysis

max time kernel
25s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 11:40

Target

d3eff497fd82747a674ea1e3b87a1251edac3f60b5e013172a9daf2a89060acc.dll
Size

141KB
MD5

a535c0c7c2f66e4411262c94710c342d
SHA1

009785998c31c1d63ad6563d07cc2c8e9b016efa
SHA256

d3eff497fd82747a674ea1e3b87a1251edac3f60b5e013172a9daf2a89060acc
SHA512

a9a4997f09ae15f8c61a6a20950529ad47aa8705fa8ab2a2183496e52cf3f00ee69ed97923b11832fc4c49c4350d85928175dbe1222a401895d840e956e10f1d
SSDEEP

3072:HuhE6zRkrsv6jdjxY2bPis4QrtkNbv0Ty:HuhisCRjxbpkZvD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1660	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1660	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1660	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1660	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1660	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1660	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1660	1940	regsvr32.exe	28
PID 1940 wrote to memory of 1660	1940	regsvr32.exe	28
PID 1660 wrote to memory of 1708	1660	regsvr32.exe	29
PID 1660 wrote to memory of 1708	1660	regsvr32.exe	29
PID 1660 wrote to memory of 1708	1660	regsvr32.exe	29
PID 1660 wrote to memory of 1708	1660	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d3eff497fd82747a674ea1e3b87a1251edac3f60b5e013172a9daf2a89060acc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d3eff497fd82747a674ea1e3b87a1251edac3f60b5e013172a9daf2a89060acc.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 304
    3⤵
    - Program crash
    PID:1708

memory/1660-56-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1940-54-0x000007FEFC0D1000-0x000007FEFC0D3000-memory.dmp

Filesize
8KB

Download