a9ddb6254e8deb40281788e8f8b0d5d74e5eeb4427058b07d2c425647faf8c79

Analysis

max time kernel
145s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 01:46

Target

a9ddb6254e8deb40281788e8f8b0d5d74e5eeb4427058b07d2c425647faf8c79.dll
Size

84KB
MD5

e3f5ba53cb106a00702b5d92ba8119f1
SHA1

9f2711b6bcd8a42caee94dafe9298a9d3a57e6ab
SHA256

a9ddb6254e8deb40281788e8f8b0d5d74e5eeb4427058b07d2c425647faf8c79
SHA512

862eb1894a196be695f69eb8eafc1bb342ca868e0d355bf0d361263e5c49f9c0ef824fe50b729271b3a38a63784cd6941184ae7ecdd5816b38c588d84de24402
SSDEEP

1536:hjRv/Hh+d6WHflaNPxPnCr73U/zc2UoR8EGszapcSf9:htvvod6gfAPVnCrDUrt/PQ9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
728	4744	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4744	4968	regsvr32.exe	81
PID 4968 wrote to memory of 4744	4968	regsvr32.exe	81
PID 4968 wrote to memory of 4744	4968	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a9ddb6254e8deb40281788e8f8b0d5d74e5eeb4427058b07d2c425647faf8c79.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a9ddb6254e8deb40281788e8f8b0d5d74e5eeb4427058b07d2c425647faf8c79.dll
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 616
    3⤵
    - Program crash
    PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4744 -ip 4744
1⤵
PID:4856

memory/4744-133-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download