9ad769984f40004fd9190c746f6e2847390cac1d634480257fd254db41802ada

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:48

Target

0eff7122800b817297693ddbba758906.dll
Size

80KB
MD5

0eff7122800b817297693ddbba758906
SHA1

4116c85f25d44771035627149c87b5c864f72c55
SHA256

9ad769984f40004fd9190c746f6e2847390cac1d634480257fd254db41802ada
SHA512

c8442296d1a5bc1eafc4fede08ddfd332c112aba6355ff6f1b2623b49f0db3481cbb8a1afc146b2931130ee58ae9d51ed5f6f0690022e8d0117315cb8ecda8c9
SSDEEP

1536:CBQ0Es8TbIuRv76LanhQGxGAQeVY0zqwzpbXLDF6gJxxQz:CBQ5s8TbIu1ianhQaQazqwzFn8gY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2804	2024	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2024	4640	regsvr32.exe	15
PID 4640 wrote to memory of 2024	4640	regsvr32.exe	15
PID 4640 wrote to memory of 2024	4640	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0eff7122800b817297693ddbba758906.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\0eff7122800b817297693ddbba758906.dll
  2⤵
  PID:2024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 596
    3⤵
    - Program crash
    PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2024 -ip 2024
1⤵
PID:632

memory/2024-0-0x0000000000640000-0x000000000067E000-memory.dmp

Filesize
248KB

Download