8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-01-2023 18:07

Target

8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
Size

2.1MB
MD5

613daed6d9b8406602f11019ba28d779
SHA1

a1b095d26ce2540de0f7b186000b498f39e7d69b
SHA256

8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648
SHA512

ef8749a347c2c2d40b9b611897409941940e4c1256f8f87914dc851a2323d83c257909544449d6b1d8d19e44bfd5634917b646100759a6f88deac9dc925608b8
SSDEEP

49152:UK9imiZQ5V0i3fmpM/iP6dzvnN3YVuMtG:UK9dNXupMjN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1716 1428 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
1716	1428	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2032 wrote to memory of 1428	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1428	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1428	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1428	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1428	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1428	2032	regsvr32.exe	regsvr32.exe
PID 2032 wrote to memory of 1428	2032	regsvr32.exe	regsvr32.exe
PID 1428 wrote to memory of 1716	1428	regsvr32.exe	WerFault.exe
PID 1428 wrote to memory of 1716	1428	regsvr32.exe	WerFault.exe
PID 1428 wrote to memory of 1716	1428	regsvr32.exe	WerFault.exe
PID 1428 wrote to memory of 1716	1428	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 348
3⤵
- Program crash
PID:1716

memory/1428-55-0x0000000000000000-mapping.dmp

Download
memory/1428-56-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1716-57-0x0000000000000000-mapping.dmp

Download
memory/2032-54-0x000007FEFC0D1000-0x000007FEFC0D3000-memory.dmp

Filesize
8KB

Download