8757725ac8d2024dd99687cca85d336e8dbee32eeaa51c18ef0dd80e78d08c6a

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:45

Target

18ebe87ede81c58c022eac9d550aa7f4.dll
Size

85KB
MD5

18ebe87ede81c58c022eac9d550aa7f4
SHA1

5418842602f51ada6e92442ed44825074a67c812
SHA256

8757725ac8d2024dd99687cca85d336e8dbee32eeaa51c18ef0dd80e78d08c6a
SHA512

18a171575f198abdcfee61e69317dfd0885669c41131fcb7c0d45220d465af01635315ae18c9d905073a0f562d918db7495b0f6031e9a77e6d25b254537b000e
SSDEEP

1536:r+6f89PTvVTVdKLgCCC8zCHX1aDw32oM4mcVoIbN12XXK2ywsQg:rdWPr934N3n3X/VoaYnK3DB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
208	3052	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3052	4980	regsvr32.exe	14
PID 4980 wrote to memory of 3052	4980	regsvr32.exe	14
PID 4980 wrote to memory of 3052	4980	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\18ebe87ede81c58c022eac9d550aa7f4.dll
1⤵
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 596
  2⤵
  - Program crash
  PID:208

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\18ebe87ede81c58c022eac9d550aa7f4.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3052 -ip 3052
1⤵
PID:3136

memory/3052-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download