731f77f9b72e60c73cf4a6bf77b4e9513f65f2af4729d331941a9e87ae1fc32f

Resubmissions

24-01-2023 13:38

23-01-2023 11:18

20-01-2023 10:30

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2023 10:30

Target

8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
Size

2.1MB
MD5

613daed6d9b8406602f11019ba28d779
SHA1

a1b095d26ce2540de0f7b186000b498f39e7d69b
SHA256

8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648
SHA512

ef8749a347c2c2d40b9b611897409941940e4c1256f8f87914dc851a2323d83c257909544449d6b1d8d19e44bfd5634917b646100759a6f88deac9dc925608b8
SSDEEP

49152:UK9imiZQ5V0i3fmpM/iP6dzvnN3YVuMtG:UK9dNXupMjN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
724	4896	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4896	2204	regsvr32.exe	82
PID 2204 wrote to memory of 4896	2204	regsvr32.exe	82
PID 2204 wrote to memory of 4896	2204	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
  2⤵
  PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 684
    3⤵
    - Program crash
    PID:724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4896 -ip 4896
1⤵
PID:4844