ac6fc0d38241f4ebc734846fcafac16df5f2f81fd9ea3aff3c45a9d88ae5a3b4

Analysis

max time kernel
157s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 20:21

Target

1bbe38e6152bfb9e21f94613375e1c6f.dll
Size

82KB
MD5

1bbe38e6152bfb9e21f94613375e1c6f
SHA1

27b98a5be0e63b05db3d26d67553c119e7bcdd38
SHA256

ac6fc0d38241f4ebc734846fcafac16df5f2f81fd9ea3aff3c45a9d88ae5a3b4
SHA512

a69312d3de5b2db808e303a170a49868785a5dc420dfc23b57f9794995d97cc45c656673ad7e71db53b7dbfec9c8b76990a8d59968fcbae8fa3557051a982ad1
SSDEEP

1536:12m5yduAwceoYWafq9ok7vKcdScNxaJPvNWlGBdh9TcAj:YIWw1pWz/9dlvyPvAI94w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	4520	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4520	2132	regsvr32.exe	88
PID 2132 wrote to memory of 4520	2132	regsvr32.exe	88
PID 2132 wrote to memory of 4520	2132	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1bbe38e6152bfb9e21f94613375e1c6f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1bbe38e6152bfb9e21f94613375e1c6f.dll
  2⤵
  PID:4520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 596
    3⤵
    - Program crash
    PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4520 -ip 4520
1⤵
PID:2420

memory/4520-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download