dbd189fcf7e85dc03b9eefd510815688347e38ab409e7d10468d2763c308f3c5

Analysis

max time kernel
146s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 17:35

Target

dbd189fcf7e85dc03b9eefd510815688347e38ab409e7d10468d2763c308f3c5.dll
Size

234KB
MD5

44c0071029f9b24943a24ba0d2eb2432
SHA1

038668b013f4179a9881cce07a8afacf54288362
SHA256

dbd189fcf7e85dc03b9eefd510815688347e38ab409e7d10468d2763c308f3c5
SHA512

05016a14930b8d2e654b4d3d0d8c60bb28541c74bc346ca5c31a01e11be7c12e4b0c46baf4f6be5b3d7908eacda631fd1e837b55f1bb23b81c5ef5c2597e38e8
SSDEEP

6144:BItkxUP26S8eylHGWIeKE/tz5jSRACLt8q:BxUP298zpGWItEd52RHG

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4268	5028	WerFault.exe	84
1936	5028	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 5028	4420	regsvr32.exe	84
PID 4420 wrote to memory of 5028	4420	regsvr32.exe	84
PID 4420 wrote to memory of 5028	4420	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dbd189fcf7e85dc03b9eefd510815688347e38ab409e7d10468d2763c308f3c5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dbd189fcf7e85dc03b9eefd510815688347e38ab409e7d10468d2763c308f3c5.dll
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 608
    3⤵
    - Program crash
    PID:4268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 632
    3⤵
    - Program crash
    PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5028 -ip 5028
1⤵
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 5028 -ip 5028
1⤵
PID:224