5db7b68c271c734923c58e79ca334dca8f4cf11bc60b4fd6fbf8e919d10cd201

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07/08/2023, 20:33

Target

5db7b68c271c734923c58e79ca334dca8f4cf11bc60b4fd6fbf8e919d10cd201.dll
Size

274KB
MD5

6f987e223d5e14f3119c0f51b0fdcc4c
SHA1

fd26e1af449009a941f70e1fad7af33d92be1e6a
SHA256

5db7b68c271c734923c58e79ca334dca8f4cf11bc60b4fd6fbf8e919d10cd201
SHA512

bd0e7f57ec5a9332d5b622cfd8f2ffe7d219cd2774bb1b096ef69e80edca37d76c400bd46bbab1cc687fe2c38beda6539d80013e65896e8211c1d04664d67fee
SSDEEP

6144:2mq85BySZPmcK6O3ry6FhD8/NoTggZ1KnLkwG:2pqBy2BZUF0oTFZ1e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
584	3024	WerFault.exe	27

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2420	3024	regsvr32.exe	28
PID 3024 wrote to memory of 2420	3024	regsvr32.exe	28
PID 3024 wrote to memory of 2420	3024	regsvr32.exe	28
PID 3024 wrote to memory of 584	3024	regsvr32.exe	29
PID 3024 wrote to memory of 584	3024	regsvr32.exe	29
PID 3024 wrote to memory of 584	3024	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5db7b68c271c734923c58e79ca334dca8f4cf11bc60b4fd6fbf8e919d10cd201.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3024 -s 292
  2⤵
  - Program crash
  PID:584