07a016a938933c766757ec5323b324e3b2ff121a5ad2036aaac934c0fd3b3d60

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 03:09

Target

0c8bda223c26995728a8963d1ee16b4e.dll
Size

88KB
MD5

0c8bda223c26995728a8963d1ee16b4e
SHA1

93fe61bb9065f0c1152ba39dcaf9a0ec474c7d0f
SHA256

07a016a938933c766757ec5323b324e3b2ff121a5ad2036aaac934c0fd3b3d60
SHA512

fd8b7660864e7e4a6dc7403845fdb23e00bfd1d440a4f88766880355f08ef71d17141ef41d3ccff923947df0bde768da6fc9008f555f2bbc42ab7130db280f70
SSDEEP

1536:rvjPaYYOaWdrDfcexxHdc+BjCtZFhCcG2BpUCi02QczJroOLuMze/NpxIshHS:rbPDjXffcWHlBWtThZBpU5oQuyefCshy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	1476	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1476	1336	regsvr32.exe	89
PID 1336 wrote to memory of 1476	1336	regsvr32.exe	89
PID 1336 wrote to memory of 1476	1336	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0c8bda223c26995728a8963d1ee16b4e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0c8bda223c26995728a8963d1ee16b4e.dll
  2⤵
  PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 596
    3⤵
    - Program crash
    PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1476 -ip 1476
1⤵
PID:1564

memory/1476-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download