82f34aade1d6e228e3eaafbae3b0f20b020f6b4dd26746e31a25d08cb885a863

Analysis

max time kernel
96s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 19:39

Target

02032d97448113c8f8b9d1025481c8bb.dll
Size

85KB
MD5

02032d97448113c8f8b9d1025481c8bb
SHA1

405bf9343a5937233d0f7e47e3b17d17a1ec1615
SHA256

82f34aade1d6e228e3eaafbae3b0f20b020f6b4dd26746e31a25d08cb885a863
SHA512

15a1bffe8e76f75e10389c7a56f70012baa547654fce31fd9bd78c14c963921fd02049c86867878956246dfa11a08c03bb99a5c93c4b7580dd3620fb498b1658
SSDEEP

1536:3ZmZZ4B5f8HbGYUoFd2ywBt76L4t9hwtOAFs/wfJehPgws5Odr6kvt4acEAe76V:3oZ2f82oFd29h6ohwtOY4wUPgVm/cED4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	1012	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 1012	4336	regsvr32.exe	87
PID 4336 wrote to memory of 1012	4336	regsvr32.exe	87
PID 4336 wrote to memory of 1012	4336	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\02032d97448113c8f8b9d1025481c8bb.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\02032d97448113c8f8b9d1025481c8bb.dll
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 564
    3⤵
    - Program crash
    PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1012 -ip 1012
1⤵
PID:2076

memory/1012-0-0x0000000000840000-0x0000000000883000-memory.dmp

Filesize
268KB

Download