1d11c54162d078fa1c68e40907af7f5719e81fae2794581a2eb29cd87b67979d

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 20:03

Target

NEAS.2ab147a24fa4e572da70d13a1ec2d750.dll
Size

267KB
MD5

2ab147a24fa4e572da70d13a1ec2d750
SHA1

fdbe875d70f672b78786a936351d86225eb1076d
SHA256

1d11c54162d078fa1c68e40907af7f5719e81fae2794581a2eb29cd87b67979d
SHA512

c1d23e48883117bf9e77ba170e48cd3dc5d41f857420d133618d183a2b2762f7bd921614f96492ef2ccc49d68cdf2575117ad2446cc6a98eeaf8dbe49e376e87
SSDEEP

3072:o0H1uc2uIu3sUKR0mmCztr5bMKdYaGWAIoMmPQ9jGeupqrp:quxm7CKWVIuArp

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
428	2428	WerFault.exe	89
4172	2428	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 2428	3516	regsvr32.exe	89
PID 3516 wrote to memory of 2428	3516	regsvr32.exe	89
PID 3516 wrote to memory of 2428	3516	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.2ab147a24fa4e572da70d13a1ec2d750.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.2ab147a24fa4e572da70d13a1ec2d750.dll
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 624
    3⤵
    - Program crash
    PID:428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 632
    3⤵
    - Program crash
    PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2428 -ip 2428
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2428 -ip 2428
1⤵
PID:3876