7cbc7942fa46f2f7db1e8c22395c384527769754aa38b2a348837c10e75e022f

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 16:59

Target

06fcacd3ecc0b625d8cc9dc34dd15efb.dll
Size

176KB
MD5

06fcacd3ecc0b625d8cc9dc34dd15efb
SHA1

2ec858d5209f42ddb8703e1a943a383b831eb0a5
SHA256

7cbc7942fa46f2f7db1e8c22395c384527769754aa38b2a348837c10e75e022f
SHA512

bed45e4fa3984e0b1c72635964b0e9a9b0e27f6048eeec8c74198d4cc417ba0b203d455e0da30367e682a609b27d5c30be66ebe3c5ccbffd07aff41cfdee2ae4
SSDEEP

3072:/BXLVMhsx5FwY2I5PgAp2DMelYBFeM4FcCG7TCnp5cvLi22yT:/BXLUI535PgFMwAcM4RG7TTvL32yT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	1312	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1312	1788	regsvr32.exe	91
PID 1788 wrote to memory of 1312	1788	regsvr32.exe	91
PID 1788 wrote to memory of 1312	1788	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\06fcacd3ecc0b625d8cc9dc34dd15efb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\06fcacd3ecc0b625d8cc9dc34dd15efb.dll
  2⤵
  PID:1312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 648
    3⤵
    - Program crash
    PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1312 -ip 1312
1⤵
PID:4512