43f26c6213f24898ac8a1f52ab6c12069fb48d0cb2a85261568a3bbc5d2897fd

Analysis

max time kernel
92s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 16:46

Target

7dbe34b6efb438d285260e219c194bc9.dll
Size

112KB
MD5

7dbe34b6efb438d285260e219c194bc9
SHA1

7d07c209110ebff365368e5a09d91926db24d2c7
SHA256

43f26c6213f24898ac8a1f52ab6c12069fb48d0cb2a85261568a3bbc5d2897fd
SHA512

959970cc2b5947a1e9a173e681ffd789c3928ef90ad7ef45b1c94f8b60e26a2e6bf935096f9ac507714dcaa652627b21a67b8ae9d832e3c9cd29ee69512a7d39
SSDEEP

3072:PKMM0PcSQYTgefKPUb1ZsCjwbrv3KSWC57VxTlGy:SM50BYsef5h+GwbTZW+LTIy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	2156	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2156	3020	regsvr32.exe	14
PID 3020 wrote to memory of 2156	3020	regsvr32.exe	14
PID 3020 wrote to memory of 2156	3020	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\7dbe34b6efb438d285260e219c194bc9.dll
1⤵
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 596
  2⤵
  - Program crash
  PID:1324

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7dbe34b6efb438d285260e219c194bc9.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2156 -ip 2156
1⤵
PID:3172

memory/2156-0-0x0000000010000000-0x000000001008A000-memory.dmp

Filesize
552KB

Download