74c83e723edea915d04c0ca534390ab1a0e331d2949d130f8fdcf16b391becac

Analysis

max time kernel
158s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 18:10

Target

5140a6be0a5c4abcce3792246761ebe5.dll
Size

140KB
MD5

5140a6be0a5c4abcce3792246761ebe5
SHA1

e137f3543c68e62916b19ab9681b48876bd8fe2f
SHA256

74c83e723edea915d04c0ca534390ab1a0e331d2949d130f8fdcf16b391becac
SHA512

7f9981a82ac25971da1fcc2d3ddea317d4e3bd2ceaa30803fc8d230a6444eed9f3bc0aaf257e59435dd3d0362579efee903cf2e0000c2a35050f64959694db3f
SSDEEP

1536:v7qHf3oX586Jvffp1oGvfWJ0OXEa/gOAh6syBIVtlhXXyM1IMK2xs/P:OAXy6JProVDD/0EsyBIPXihMK2xW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	2536	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 2536	4812	regsvr32.exe	90
PID 4812 wrote to memory of 2536	4812	regsvr32.exe	90
PID 4812 wrote to memory of 2536	4812	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5140a6be0a5c4abcce3792246761ebe5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5140a6be0a5c4abcce3792246761ebe5.dll
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 596
    3⤵
    - Program crash
    PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2536 -ip 2536
1⤵
PID:836

memory/2536-0-0x0000000000A00000-0x0000000000A3F000-memory.dmp

Filesize
252KB

Download