a845316b6355280c882fe8e97edb5e99ca429f3daf3457469e66f520ffcd4155

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 23:53

Target

07a77db1e31e7bb691a1b539d69161fc.dll
Size

88KB
MD5

07a77db1e31e7bb691a1b539d69161fc
SHA1

d310ad0853c2670e0c0b2db572c99d3b61c05d73
SHA256

a845316b6355280c882fe8e97edb5e99ca429f3daf3457469e66f520ffcd4155
SHA512

965fde293d33b085d1c17c22b429dd25b86f040613e85ae327dfe1604ca62be349f58f2285a5fd1ea1390caa46647c68de638c4308b4b3a8fa80d9f0ef3544fc
SSDEEP

1536:W28XlHvELCsFcSFhv3VjRkM8bZ/pI7UncxMA42Abp3jerK8tMfqZ5qqKaf6njN:W1Xl4cSFhv3VjRob10Li72uBjt8if86J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	1748	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1748	1716	regsvr32.exe	15
PID 1716 wrote to memory of 1748	1716	regsvr32.exe	15
PID 1716 wrote to memory of 1748	1716	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07a77db1e31e7bb691a1b539d69161fc.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\07a77db1e31e7bb691a1b539d69161fc.dll
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 596
    3⤵
    - Program crash
    PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1748 -ip 1748
1⤵
PID:3472

memory/1748-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download