9576a7b73bfa1389284097721f82910b7a48f8d5d980c9857fba7536148f20e2

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2023, 01:24

Target

8d8b65c814f1ba2f3e0204289645501ac84b5641.dll
Size

356KB
MD5

9244db61af49f0fe9e79abd2b1d81b3a
SHA1

8d8b65c814f1ba2f3e0204289645501ac84b5641
SHA256

9576a7b73bfa1389284097721f82910b7a48f8d5d980c9857fba7536148f20e2
SHA512

d47ad3380bb6f0f6f249fe9f02e1426f410cb12e8fec5d4b23feddb36a1f3481ab3cf5b766c4651f3f806f9a466722a50d0deb0f4e38ae138b0070108b0f8dd6
SSDEEP

6144:eRXweGsCJH2mMnpyxT5oz9QVAG5e4ZIrA/qTX1pGlMNvBv:qZNCMJkTocs4ZIzGlwvBv

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3360	4988	WerFault.exe	82
2124	4988	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 4988	4936	regsvr32.exe	82
PID 4936 wrote to memory of 4988	4936	regsvr32.exe	82
PID 4936 wrote to memory of 4988	4936	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8d8b65c814f1ba2f3e0204289645501ac84b5641.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8d8b65c814f1ba2f3e0204289645501ac84b5641.dll
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 604
    3⤵
    - Program crash
    PID:3360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 628
    3⤵
    - Program crash
    PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4988 -ip 4988
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4988 -ip 4988
1⤵
PID:4628