38b1c3537f077e4a21c67f0d9f44c1ab28a3452af19d3ff92d623794badf5e88

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-02-2023 10:17

Target

8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
Size

2.1MB
MD5

613daed6d9b8406602f11019ba28d779
SHA1

a1b095d26ce2540de0f7b186000b498f39e7d69b
SHA256

8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648
SHA512

ef8749a347c2c2d40b9b611897409941940e4c1256f8f87914dc851a2323d83c257909544449d6b1d8d19e44bfd5634917b646100759a6f88deac9dc925608b8
SSDEEP

49152:UK9imiZQ5V0i3fmpM/iP6dzvnN3YVuMtG:UK9dNXupMjN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1152 1692 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
1152	1692	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1524 wrote to memory of 1692	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 1692	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 1692	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 1692	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 1692	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 1692	1524	regsvr32.exe	regsvr32.exe
PID 1524 wrote to memory of 1692	1524	regsvr32.exe	regsvr32.exe
PID 1692 wrote to memory of 1152	1692	regsvr32.exe	WerFault.exe
PID 1692 wrote to memory of 1152	1692	regsvr32.exe	WerFault.exe
PID 1692 wrote to memory of 1152	1692	regsvr32.exe	WerFault.exe
PID 1692 wrote to memory of 1152	1692	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 348
3⤵
- Program crash
PID:1152

memory/1152-57-0x0000000000000000-mapping.dmp

Download
memory/1524-54-0x000007FEFB5E1000-0x000007FEFB5E3000-memory.dmp

Filesize
8KB

Download
memory/1692-55-0x0000000000000000-mapping.dmp

Download
memory/1692-56-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download