9d7522ee51219cc8e04c22798494dfec31a084507e8f30fc03c462d64277f45e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 11:13

Target

69ffcc5b62eee18c996b51494e2638aa.dll
Size

120KB
MD5

69ffcc5b62eee18c996b51494e2638aa
SHA1

5df3e1c20e013dec2c775ab1d04251c521ead95a
SHA256

9d7522ee51219cc8e04c22798494dfec31a084507e8f30fc03c462d64277f45e
SHA512

d093ca61e8c3f58880cea68871cdf7eed7032bd1d610b77ca0460a2b44ffea03595f897c2ba3531c916ba6f5e9a3f93c9935c99857169cb0f2a887fa6c747641
SSDEEP

768:Ry5q4QGnoI2PHJdvrGFT72G3qnZ/lJxgr9rqQD+AfqkQwEANiBqCXpx+:I5q4QctGTe7O/PSrrD+Sq+gqCXpx+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2616	4556	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4556	2384	regsvr32.exe	15
PID 2384 wrote to memory of 4556	2384	regsvr32.exe	15
PID 2384 wrote to memory of 4556	2384	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\69ffcc5b62eee18c996b51494e2638aa.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\69ffcc5b62eee18c996b51494e2638aa.dll
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 636
    3⤵
    - Program crash
    PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4556 -ip 4556
1⤵
PID:4596

memory/4556-0-0x0000000000520000-0x000000000053E000-memory.dmp

Filesize
120KB

Download