2cc37659a885df758b5c58ce767fe0c6dba9b77009ee28b72eedb01655e11f65

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2023 07:36

Target

2cc37659a885df758b5c58ce767fe0c6dba9b77009ee28b72eedb01655e11f65.dll
Size

6.5MB
MD5

cade1e0677024123de1da6d4f876e923
SHA1

e27fb7375b54239d729aef1075fb1259dcfa5e58
SHA256

2cc37659a885df758b5c58ce767fe0c6dba9b77009ee28b72eedb01655e11f65
SHA512

5ff14b438ce1e0f9b1ea73864d18a3aa6927b6c348bfe151344c2bc41271b4bc313a722e1c8454546b247f83cf3b15dd8b6d1b2c386b8aeff5f4a8ce1bb90995
SSDEEP

98304:QmWMpd9xotayiD5QjbmScHMmMNzCYkeyrLAwQLASjZGQoSkbRFcd:QzMpd9xoUy85QjbmScHMmMNzCYyE1iRQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5096	3640	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3640	5020	regsvr32.exe	85
PID 5020 wrote to memory of 3640	5020	regsvr32.exe	85
PID 5020 wrote to memory of 3640	5020	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2cc37659a885df758b5c58ce767fe0c6dba9b77009ee28b72eedb01655e11f65.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2cc37659a885df758b5c58ce767fe0c6dba9b77009ee28b72eedb01655e11f65.dll
  2⤵
  PID:3640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 608
    3⤵
    - Program crash
    PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3640 -ip 3640
1⤵
PID:3684