f685dd97966ca0db14c417cd3719cc55aad196328303a95d3f896b582b7cf2b8

Analysis

max time kernel
143s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:30

Target

089ebf549a54ffd47419754b2a4a1b47.dll
Size

85KB
MD5

089ebf549a54ffd47419754b2a4a1b47
SHA1

63150a78295cdf80445586d8e540fb8d10e51237
SHA256

f685dd97966ca0db14c417cd3719cc55aad196328303a95d3f896b582b7cf2b8
SHA512

0663a3ead6426768836e11bea0468356fad5672839a27653001ec279cfd15e5fb432ddf4dbaf5d7624e372c7ea73d74562dc0ac7754cce4baca717b654ec62be
SSDEEP

1536:lvMHPiWVXVug0qZz3Ud7MzUwJlN3Pw8el467YbwBHq0sS9k4rk7TzrEm73L7jrVd:iaS0g0qZzkhgjlU4vbwBHQuPkfvEevmk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3112	4744	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 4744	700	regsvr32.exe	90
PID 700 wrote to memory of 4744	700	regsvr32.exe	90
PID 700 wrote to memory of 4744	700	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\089ebf549a54ffd47419754b2a4a1b47.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\089ebf549a54ffd47419754b2a4a1b47.dll
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 596
    3⤵
    - Program crash
    PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4744 -ip 4744
1⤵
PID:4992

memory/4744-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4744-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download