731f77f9b72e60c73cf4a6bf77b4e9513f65f2af4729d331941a9e87ae1fc32f

Resubmissions

24-01-2023 13:38

23-01-2023 11:18

20-01-2023 10:30

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2023 13:38

Target

8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
Size

2.1MB
MD5

613daed6d9b8406602f11019ba28d779
SHA1

a1b095d26ce2540de0f7b186000b498f39e7d69b
SHA256

8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648
SHA512

ef8749a347c2c2d40b9b611897409941940e4c1256f8f87914dc851a2323d83c257909544449d6b1d8d19e44bfd5634917b646100759a6f88deac9dc925608b8
SSDEEP

49152:UK9imiZQ5V0i3fmpM/iP6dzvnN3YVuMtG:UK9dNXupMjN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2340 4984 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
2340	4984	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 5056 wrote to memory of 4984	5056	regsvr32.exe	regsvr32.exe
PID 5056 wrote to memory of 4984	5056	regsvr32.exe	regsvr32.exe
PID 5056 wrote to memory of 4984	5056	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
2⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 684
3⤵
- Program crash
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4984 -ip 4984
1⤵
PID:4976