d00ba4f2ba74ac880be6e2090ffc662abf1803b5fb9c30617f78576813840a40

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 07:59

Target

58671a8857e69413cf6474473dfa0c12.dll
Size

116KB
MD5

58671a8857e69413cf6474473dfa0c12
SHA1

ee7ea8e50f38e0337b92c1b763e50fd093c18329
SHA256

d00ba4f2ba74ac880be6e2090ffc662abf1803b5fb9c30617f78576813840a40
SHA512

9d78cedb1dc86c55df339a4457baed949767942f207eddc051fa5c2c68d8084081381f8b85156954677d8bd6af6082c9a5383d682a756ff1f85d157252faff45
SSDEEP

768:ioi5qZO+QeSPozbizFNpy8Oqvj+kQxSBFq0gMrs/fM3AwITl0FhH5bwVZtrDh:iv5qZnQCzbYKgK0ns83yTl0vH5baZz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4784	1272	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1272	2060	regsvr32.exe	87
PID 2060 wrote to memory of 1272	2060	regsvr32.exe	87
PID 2060 wrote to memory of 1272	2060	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\58671a8857e69413cf6474473dfa0c12.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\58671a8857e69413cf6474473dfa0c12.dll
  2⤵
  PID:1272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 636
    3⤵
    - Program crash
    PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1272 -ip 1272
1⤵
PID:4700

memory/1272-0-0x00000000003E0000-0x00000000003FD000-memory.dmp

Filesize
116KB

Download