b03c25c3f7d1c9b84d52c597637331eabb2ce4d1ad1065dbf4f5e1bb7488ee90

Analysis

max time kernel
137s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 20:30

Target

518a6227175569392d47d90daddc9042.dll
Size

90KB
MD5

518a6227175569392d47d90daddc9042
SHA1

8eb100ab72a4adc5a5d70a6b77efc5ae9dcbb4f2
SHA256

b03c25c3f7d1c9b84d52c597637331eabb2ce4d1ad1065dbf4f5e1bb7488ee90
SHA512

85f40d8563fc219d5bfe1335d38424458ec97b5291fbf1d06462f7afd58196d3f0acb5c98c58466e1035d5d22e226ebc5e62cce15751e5de4607a5d7a6b47e9e
SSDEEP

1536:TJgfHUbnZywKLG6xes0AVJ1fA1hxoDpOFaiIvXwt77pD8SdCXQnaz4zVs0A2:TqHIAxVxeMVnI1ZIfm7WkNzVM2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4428	836	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 836	1120	regsvr32.exe	88
PID 1120 wrote to memory of 836	1120	regsvr32.exe	88
PID 1120 wrote to memory of 836	1120	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\518a6227175569392d47d90daddc9042.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\518a6227175569392d47d90daddc9042.dll
  2⤵
  PID:836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 596
    3⤵
    - Program crash
    PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 836 -ip 836
1⤵
PID:1044

memory/836-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download