1e255962fe3aaaec53b128e0f90df4e501daf2d772699b65885520e2279b05f1

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 01:39

Target

3b91491f249ea99799b7a18763198741.dll
Size

82KB
MD5

3b91491f249ea99799b7a18763198741
SHA1

b6d955836942f79aae6f42ebd9d24b4a3fcd35b3
SHA256

1e255962fe3aaaec53b128e0f90df4e501daf2d772699b65885520e2279b05f1
SHA512

30217d770907befed6657fff1dbf67891daaee32b025ecb1fd60943ed8f11831d17f548bdfd0beceae2eb35916b02958995ce48293dfda3f289b52ff20df412e
SSDEEP

1536:w+TxFAOVTZQO0vCT73YSE4qUFixPLw0qSEAB99o3ejmiD7x/EXgbrv6mUrKF2w+b:BA+ZQOzFiv5BE3WXDtqGAw+b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	316	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 316	1212	regsvr32.exe	89
PID 1212 wrote to memory of 316	1212	regsvr32.exe	89
PID 1212 wrote to memory of 316	1212	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b91491f249ea99799b7a18763198741.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\3b91491f249ea99799b7a18763198741.dll
  2⤵
  PID:316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 596
    3⤵
    - Program crash
    PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 316 -ip 316
1⤵
PID:2076

memory/316-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download