da51f459dd008dd6fcb62ecdc7fe2b7c033fcdced47526c516804a4c4adeb7d8

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:09

Target

11cb1b6217b9f692e7bf65f5b1171999.dll
Size

86KB
MD5

11cb1b6217b9f692e7bf65f5b1171999
SHA1

e2cad246c58daf427884c11ab2aefab4f6f879f2
SHA256

da51f459dd008dd6fcb62ecdc7fe2b7c033fcdced47526c516804a4c4adeb7d8
SHA512

088d0861179ce9637be289f02e185b0070bc37abaaf7363618ce38fb2d9a6c7aa6831891f4eadadeb66d22579070c48dee01495b96ffe8fd2a982e92346d70f4
SSDEEP

1536:iJ0ZgcldlQ1/kbt+XSnrsduqDcg3NwZMAMndt2jSKsQF8gRdBafbUq1F/rS:SCgcPi1/kx+ina7aVMErsQFe44lG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4232	3440	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 3440	1308	regsvr32.exe	15
PID 1308 wrote to memory of 3440	1308	regsvr32.exe	15
PID 1308 wrote to memory of 3440	1308	regsvr32.exe	15

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\11cb1b6217b9f692e7bf65f5b1171999.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\11cb1b6217b9f692e7bf65f5b1171999.dll
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 596
    3⤵
    - Program crash
    PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3440 -ip 3440
1⤵
PID:3952

memory/3440-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download