6bb547b4b36e9aa1e2af887b18a3f056bd568c7dbd94b5b12ba531c0c1f89661

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 21:27

Target

12f3fa597ffa8952a4f5d37665394cc6.dll
Size

116KB
MD5

12f3fa597ffa8952a4f5d37665394cc6
SHA1

1f548929e90bd97c394252199101ae86d319e953
SHA256

6bb547b4b36e9aa1e2af887b18a3f056bd568c7dbd94b5b12ba531c0c1f89661
SHA512

47ea7613aa2728d8a53a2bb0e965697f867fa653c476530f0fa125bd4a48e5fb3d2705e2d59aa172a6c9145cb462c0b5a4b535a0b32da8719bb9878dc10b993d
SSDEEP

3072:FN0GxvNd6zH7Qmb/GcndhkCudjLOadSScvuvuYCqkly8lo4mmmok9:FNnVParGvunqkl/lo4Du

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3636	2944	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2944	2664	regsvr32.exe	89
PID 2664 wrote to memory of 2944	2664	regsvr32.exe	89
PID 2664 wrote to memory of 2944	2664	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\12f3fa597ffa8952a4f5d37665394cc6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\12f3fa597ffa8952a4f5d37665394cc6.dll
  2⤵
  PID:2944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 660
    3⤵
    - Program crash
    PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2944 -ip 2944
1⤵
PID:756