5886142b6cc786a00930bcc95dc4904ca77bfa1035e77bcaa29bd8708f429781

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 16:05

Target

53f76c076f281cf59c4648979f04e285.dll
Size

77KB
MD5

53f76c076f281cf59c4648979f04e285
SHA1

878063777c0bee6c44eac7274828d35ad9ace790
SHA256

5886142b6cc786a00930bcc95dc4904ca77bfa1035e77bcaa29bd8708f429781
SHA512

d7a913119d52853f002a6aea9ba25694a97fd16262e90209b7af0b2a7d8c1d655c3061529b22703c7db22df0aa4e9b0d070f249be8b649295e42da2f2d4c2321
SSDEEP

1536:RgSNyhyhIXgloTwtVRc76H4iCGNTjuUkk/lb2Rm8WLK7:RYhoIViqJTijuU3db2RxOu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2384	4768	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 4768	4040	regsvr32.exe	88
PID 4040 wrote to memory of 4768	4040	regsvr32.exe	88
PID 4040 wrote to memory of 4768	4040	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\53f76c076f281cf59c4648979f04e285.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\53f76c076f281cf59c4648979f04e285.dll
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 596
    3⤵
    - Program crash
    PID:2384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4768 -ip 4768
1⤵
PID:1568

memory/4768-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download