3d65f1685167c36b0c54069e0ae1208a86db1fb29f5124af032565717bac2dad

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/02/2024, 22:07

Target

87c7fb94af0b3ccd6a224242ef61d04d.dll
Size

89KB
MD5

87c7fb94af0b3ccd6a224242ef61d04d
SHA1

03f70d52c10a98cd9c8b6d85c04ad335eadf4a7d
SHA256

3d65f1685167c36b0c54069e0ae1208a86db1fb29f5124af032565717bac2dad
SHA512

05631d31c2e5a842ad28be5166ce7f7bda00c5da8dcce560a7dc08eb1bcd217342ad2d3f0b52dce297431b586ca9dbdff79c7ae1d84728e68718ee46647d15a6
SSDEEP

1536:qf5iwvF7Tpqmq3ZA9R7YboD3hS1Uh0956GtoYk1ppVdl7PybhOfyI+boU:U5RvF7Tkmq3ZqR7Y0D3eUh666oYk15ze

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
544	3212	WerFault.exe	22

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3212	3664	regsvr32.exe	22
PID 3664 wrote to memory of 3212	3664	regsvr32.exe	22
PID 3664 wrote to memory of 3212	3664	regsvr32.exe	22

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\87c7fb94af0b3ccd6a224242ef61d04d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\87c7fb94af0b3ccd6a224242ef61d04d.dll
  2⤵
  PID:3212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 596
    3⤵
    - Program crash
    PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3212 -ip 3212
1⤵
PID:5084

memory/3212-1-0x0000000000910000-0x0000000000953000-memory.dmp

Filesize
268KB

Download
memory/3212-0-0x0000000000910000-0x0000000000953000-memory.dmp

Filesize
268KB

Download
memory/3212-2-0x0000000000910000-0x0000000000953000-memory.dmp

Filesize
268KB

Download