22838dfcd8953ae210c396cbf1bb6ffce6a0d5164e3ab62088d5043f5006ecfb

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2024 08:08

Target

55ed7bcd1185269c5b4c9ed7330e7597.dll
Size

83KB
MD5

55ed7bcd1185269c5b4c9ed7330e7597
SHA1

e6360b814359f588df59b07be3e916af86ce762b
SHA256

22838dfcd8953ae210c396cbf1bb6ffce6a0d5164e3ab62088d5043f5006ecfb
SHA512

86eba296c0b57a27765ad2f398416ba0c284f2567d659f717fedc519629c90ca62622777704aee32b6af70b57f36cbbce62a39df218dac32925c03827fcb1102
SSDEEP

1536:DZbq+3iXOHaKwR7NPy+Opch5NLIJdJ6Xewmz4WbJT5XteDJw45x0KtrjHohi:D5qgkn7I8LLIJOO1Petf0yjci

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4276	1684	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1684	868	regsvr32.exe	14
PID 868 wrote to memory of 1684	868	regsvr32.exe	14
PID 868 wrote to memory of 1684	868	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\55ed7bcd1185269c5b4c9ed7330e7597.dll
1⤵
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 596
  2⤵
  - Program crash
  PID:4276

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\55ed7bcd1185269c5b4c9ed7330e7597.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1684 -ip 1684
1⤵
PID:3892

memory/1684-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download