e93e3dfd77d9be670f947035baf154cea9971af7e764ef9a0afd7d84edd435f8

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:29

Target

130234bb041147fa0999831d68847aa5.dll
Size

611KB
MD5

130234bb041147fa0999831d68847aa5
SHA1

eefb265ba7ab6f12514d11f9e355616b3db11aa8
SHA256

e93e3dfd77d9be670f947035baf154cea9971af7e764ef9a0afd7d84edd435f8
SHA512

56b72fbf5eae7677bbbf3788e2ac89edfa2239eacb7de47294721e454f05543a315731d1ef92e924ae5bf5a4fbac9085895885756193da9404cc7bd387c0f928
SSDEEP

12288:ryA1ZdqVfv/6HftOIA3+00wstpSdCi3TLdLOGPtwRVBwIHeIBv7pj:f1fqZCHwIr00taCiHp6RHeIBT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	1960	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1960	2440	regsvr32.exe	28
PID 2440 wrote to memory of 1960	2440	regsvr32.exe	28
PID 2440 wrote to memory of 1960	2440	regsvr32.exe	28
PID 2440 wrote to memory of 1960	2440	regsvr32.exe	28
PID 2440 wrote to memory of 1960	2440	regsvr32.exe	28
PID 2440 wrote to memory of 1960	2440	regsvr32.exe	28
PID 2440 wrote to memory of 1960	2440	regsvr32.exe	28
PID 1960 wrote to memory of 3024	1960	regsvr32.exe	29
PID 1960 wrote to memory of 3024	1960	regsvr32.exe	29
PID 1960 wrote to memory of 3024	1960	regsvr32.exe	29
PID 1960 wrote to memory of 3024	1960	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\130234bb041147fa0999831d68847aa5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\130234bb041147fa0999831d68847aa5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 296
    3⤵
    - Program crash
    PID:3024

memory/1960-0-0x0000000002250000-0x00000000022EE000-memory.dmp

Filesize
632KB

Download
memory/1960-1-0x0000000002250000-0x00000000022EE000-memory.dmp

Filesize
632KB

Download