6dee2344f26d96eb6c4b37497aba549df51851169442a63c6e1292df95a7a67e

Analysis

max time kernel
148s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:27

Target

37fba24694d9f2181cd5aa8f8484c051.dll
Size

83KB
MD5

37fba24694d9f2181cd5aa8f8484c051
SHA1

fca95acbddc8bafdd735070d4cd3eb774f019535
SHA256

6dee2344f26d96eb6c4b37497aba549df51851169442a63c6e1292df95a7a67e
SHA512

3e416a4362a0fcedb953e9b36b6a0bb908e51fae70ae4aa19a28339b6dc08fef1de8d659d032722aa46229b72d4b24dcfa03852d347dd6982065226dbde19985
SSDEEP

1536:r0V9DHD2pRzqX1yvQP9AepRPF0h8k79Pl5E0HW6rS0nE+Gwbf6:gVp6juF/iepRPFidkQtEW6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4160	3192	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3192	228	regsvr32.exe	16
PID 228 wrote to memory of 3192	228	regsvr32.exe	16
PID 228 wrote to memory of 3192	228	regsvr32.exe	16

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\37fba24694d9f2181cd5aa8f8484c051.dll
1⤵
PID:3192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 568
  2⤵
  - Program crash
  PID:4160

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\37fba24694d9f2181cd5aa8f8484c051.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3192 -ip 3192
1⤵
PID:4324

memory/3192-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download