670e3d3e99d2aca498fa520e4058c802bcc2600ebe31748e0b19cba0f4ae58b4

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2023 05:56

Target

contactsUX.dll
Size

331KB
MD5

54ee6a204238313dc6aca21c7e036c17
SHA1

531fd1c18e2e4984c72334eb56af78a1048da6c7
SHA256

0abf68b8409046a1555d48ac506fd26fda4b29d8d61e07bc412a4e21de2782fd
SHA512

19a2e371712aab54b75059d39a9aea6e7de2eb69b3ffc0332e60df617ebb9de61571b2ca722cddb75c9cbc79f8200d03f73539f21f69366eae3c7641731c7820
SSDEEP

6144:zLU98dTLLPTtdO37tzHzjRzPSzHKBJupBzC8vAocIGhL99WP+gDjX5oOyOta3H/C:P9PLrtShzHzjRMcQpsSCTO2H/Kj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3944	3064	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 3064	3764	regsvr32.exe	86
PID 3764 wrote to memory of 3064	3764	regsvr32.exe	86
PID 3764 wrote to memory of 3064	3764	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\contactsUX.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\contactsUX.dll
  2⤵
  PID:3064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 692
    3⤵
    - Program crash
    PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3064 -ip 3064
1⤵
PID:3552

memory/3064-0-0x0000000000930000-0x0000000000939000-memory.dmp

Filesize
36KB

Download