d644e61af32c4e6e7657859593a037c2b62878ff07883d4de564d414ef7a58ea

Analysis

max time kernel
102s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2023 00:04

Target

8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
Size

2.1MB
MD5

613daed6d9b8406602f11019ba28d779
SHA1

a1b095d26ce2540de0f7b186000b498f39e7d69b
SHA256

8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648
SHA512

ef8749a347c2c2d40b9b611897409941940e4c1256f8f87914dc851a2323d83c257909544449d6b1d8d19e44bfd5634917b646100759a6f88deac9dc925608b8
SSDEEP

49152:UK9imiZQ5V0i3fmpM/iP6dzvnN3YVuMtG:UK9dNXupMjN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3768 4932 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
3768	4932	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1180 wrote to memory of 4932	1180	regsvr32.exe	regsvr32.exe
PID 1180 wrote to memory of 4932	1180	regsvr32.exe	regsvr32.exe
PID 1180 wrote to memory of 4932	1180	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
2⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 696
3⤵
- Program crash
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4932 -ip 4932
1⤵
PID:1360