5fd2f57e1ee0650d3aa83023540e686962ce82bdecca003e7849893e4326a6b3

Analysis

max time kernel
148s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 00:02

Target

1b7baadd20f9cdfd09b5bba10490af12.dll
Size

225KB
MD5

1b7baadd20f9cdfd09b5bba10490af12
SHA1

544d705bf9be0c80044fe054b5ca851690eda1bf
SHA256

5fd2f57e1ee0650d3aa83023540e686962ce82bdecca003e7849893e4326a6b3
SHA512

b28c122dec2fdf097760db8bdb69355f2cc3fa101d44de74a82a717c61cda3a602f19e2b8da063ac976844521284f0599b420b5e85528a525dd21e65dbc01aea
SSDEEP

3072:Tw6Nke6gu8U0kDw+PNXRbzWyGrj6JhKv8TEgY2zZAJ0tEpgtg9HguPt+AFqnPJ86:U6Nke5UdNXRbCfnohBTY2VGpgtw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4832	4868	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 4868	1016	regsvr32.exe	23
PID 1016 wrote to memory of 4868	1016	regsvr32.exe	23
PID 1016 wrote to memory of 4868	1016	regsvr32.exe	23

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1b7baadd20f9cdfd09b5bba10490af12.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1b7baadd20f9cdfd09b5bba10490af12.dll
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 656
    3⤵
    - Program crash
    PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4868 -ip 4868
1⤵
PID:700

memory/4868-0-0x0000000010000000-0x000000001007D000-memory.dmp

Filesize
500KB

Download
memory/4868-1-0x0000000010000000-0x000000001007D000-memory.dmp

Filesize
500KB

Download