2f53d7cac5006981b445cf6a41f5549600469b4ab45473835159c7856362890c

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 15:17

Target

53ddb61cf02a398c78f21b450c2e2c96.dll
Size

86KB
MD5

53ddb61cf02a398c78f21b450c2e2c96
SHA1

dfd75ca5ea09770c5e6e38d8fd475a6928a2d2e7
SHA256

2f53d7cac5006981b445cf6a41f5549600469b4ab45473835159c7856362890c
SHA512

e4d0de31c9032294178e352b190733e8b9667436e2a18285fa64912e817bad4093b91fa78a1f2c96bdabdd46e603180e83cdc5ec023b22a6794aecfa64f137dc
SSDEEP

1536:+Rb102l4vhIPlQUWRzPH16ppBBZYi60xURGMDCON3YfqU3GSXXW+NJdcfgtzii1a:yb102lJPlQrRzPc1ZYidxUxDBFYhztkt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	3632	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3632	2840	regsvr32.exe	87
PID 2840 wrote to memory of 3632	2840	regsvr32.exe	87
PID 2840 wrote to memory of 3632	2840	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\53ddb61cf02a398c78f21b450c2e2c96.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\53ddb61cf02a398c78f21b450c2e2c96.dll
  2⤵
  PID:3632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 596
    3⤵
    - Program crash
    PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3632 -ip 3632
1⤵
PID:2488

memory/3632-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download