5fd2f57e1ee0650d3aa83023540e686962ce82bdecca003e7849893e4326a6b3

Analysis

max time kernel
148s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 00:02

Target
1b7baadd20f9cdfd09b5bba10490af12.dll
Size 225KB
Sample231225-abvmlsgdej
SHA256 5fd2f57e1ee0650d3aa83023540e686962ce82bdecca003e7849893e4326a6b3
MD5 1b7baadd20f9cdfd09b5bba10490af12
SHA1 544d705bf9be0c80044fe054b5ca851690eda1bf
SHA512 b28c122dec2fdf097760db8bdb69355f2cc3fa101d44de74a82a717c61cda3a602f19e2b8da063ac976844521284f0599b420b5e85528a525dd21e65dbc01aea
SSDEEP 3072:Tw6Nke6gu8U0kDw+PNXRbzWyGrj6JhKv8TEgY2zZAJ0tEpgtg9HguPt+AFqnPJ86:U6Nke5UdNXRbCfnohBTY2VGpgtw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4832	4868	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 4868	1016	regsvr32.exe	23
PID 1016 wrote to memory of 4868	1016	regsvr32.exe	23
PID 1016 wrote to memory of 4868	1016	regsvr32.exe	23

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b7baadd20f9cdfd09b5bba10490af12.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1b7baadd20f9cdfd09b5bba10490af12.dll
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 656
    3⤵
    - Program crash
    PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4868 -ip 4868
1⤵
PID:700

memory/4868-0-0x0000000010000000-0x000000001007D000-memory.dmp

Download

memory/4868-1-0x0000000010000000-0x000000001007D000-memory.dmp

Download