8321cca827229ca13c5c2d33cc55011e3fe9b4a130edf373e49913ee60e1751e

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 19:18

Target

017c9fe41fbc7dda4ab9a2ce5017eeb6.dll
Size

91KB
MD5

017c9fe41fbc7dda4ab9a2ce5017eeb6
SHA1

ec029f8f471fed941a732de015af6b0a17340872
SHA256

8321cca827229ca13c5c2d33cc55011e3fe9b4a130edf373e49913ee60e1751e
SHA512

737c50da0d3484d49edb507274c6702f8d5c1f5b513fdcbea16693463bc2be2536ca343ed186edf373653c335de8a1558a3b3a2d4bf3640f8e5bad91841f083d
SSDEEP

1536:Is2XXMJQbu8v+44vSxuQFCvksWiLEfW9a9SOPeFdJRblTb3xgTmhV2Ooc4xm0U2N:Is2jipRAuQ/iLEfzyDrpTb33hEdc431j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	1648	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 1648	4936	regsvr32.exe	14
PID 4936 wrote to memory of 1648	4936	regsvr32.exe	14
PID 4936 wrote to memory of 1648	4936	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\017c9fe41fbc7dda4ab9a2ce5017eeb6.dll
1⤵
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 596
  2⤵
  - Program crash
  PID:2780

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\017c9fe41fbc7dda4ab9a2ce5017eeb6.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1648 -ip 1648
1⤵
PID:3584

memory/1648-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download