bd93837807d81a2434269fe6f145f91281366e559484f07dc548774c1cab8436

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 03:15

Target

bd93837807d81a2434269fe6f145f91281366e559484f07dc548774c1cab8436.dll
Size

91KB
MD5

c1d8276cb483d19b9ec1dd01887db21f
SHA1

bd4cc1defdc0788cfcb8256a93658fa5e155f8a7
SHA256

bd93837807d81a2434269fe6f145f91281366e559484f07dc548774c1cab8436
SHA512

2beb9229bfa03f6f42a9780d99c8dc65d044c59cc63ef42d4c9de813debd37d7e27448d2ab29c4c829414d14d26992bee42365ebff00c0ec65ef476126909bd3
SSDEEP

1536:vGl9JtL3YwBx0UimNQv8uh+YyBx1+wX2m785UQojfhJh1bHskytDWtzAujdlQvS:vGzJ53YPmNu+Y6G5y7fbp0yRjdlp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4480	5072	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 5072	5036	regsvr32.exe	81
PID 5036 wrote to memory of 5072	5036	regsvr32.exe	81
PID 5036 wrote to memory of 5072	5036	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bd93837807d81a2434269fe6f145f91281366e559484f07dc548774c1cab8436.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bd93837807d81a2434269fe6f145f91281366e559484f07dc548774c1cab8436.dll
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 604
    3⤵
    - Program crash
    PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5072 -ip 5072
1⤵
PID:2260

memory/5072-133-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download