feef7c585a67e368ce1a514158d6abc280e502b0408ad8b589d83687360ff11f

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29-06-2023 21:58

Target

3b0dce669a07626746d3b2301607702abd3bb2cba8dcb9c8b655f246e7b8ab1d.dll
Size

46KB
MD5

008675ad6fc2ed2b17cd19dfadc0e766
SHA1

0f1420ba4c089b7a0b07427058af8e15a4f59346
SHA256

3b0dce669a07626746d3b2301607702abd3bb2cba8dcb9c8b655f246e7b8ab1d
SHA512

ee9a455c5da82e29b3944f5d84db240e60298980311b0da09c53c50b20cfa6fa4fd9bd26562838e6a0442a5b043724351a39bc67803aa90c7f8e1330c8f84413
SSDEEP

768:DDJTV0YbZiAbYZSesRQxqz5qzGI4reLkfLe48tfpFtJoTpH6Ri:fJTV0QkNuQx252GI4ReHtLDApaE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

916 924 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
916	924	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1448 wrote to memory of 924	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 924	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 924	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 924	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 924	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 924	1448	regsvr32.exe	regsvr32.exe
PID 1448 wrote to memory of 924	1448	regsvr32.exe	regsvr32.exe
PID 924 wrote to memory of 916	924	regsvr32.exe	WerFault.exe
PID 924 wrote to memory of 916	924	regsvr32.exe	WerFault.exe
PID 924 wrote to memory of 916	924	regsvr32.exe	WerFault.exe
PID 924 wrote to memory of 916	924	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b0dce669a07626746d3b2301607702abd3bb2cba8dcb9c8b655f246e7b8ab1d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3b0dce669a07626746d3b2301607702abd3bb2cba8dcb9c8b655f246e7b8ab1d.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 296
3⤵
- Program crash
PID:916