b7317adf6411ccc297bedb0b8cecf28b39670592e1a5707f055e69f5e7e7694e

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 06:03

Target

ab2dc29e5425bfa5395745be1d35f607.dll
Size

79KB
MD5

ab2dc29e5425bfa5395745be1d35f607
SHA1

876f439dfcc86a5efba96cee7b18d6e9b0e9c547
SHA256

b7317adf6411ccc297bedb0b8cecf28b39670592e1a5707f055e69f5e7e7694e
SHA512

c48f14ccc64ee279b83a39d7290a746a007dd284f6b24b61c46c0d0b79e7af38bcf115039fb2d1409ccf4e10b0471397f233c319d2eb0c5a6a17c8be5fe11b50
SSDEEP

1536:jpaNabCuYt4M5AAMCdNAL4bC4hTLWWc1k5S8urONgYQ70oE+Av:Ejug4MWdCT6yLWWcrDM4705+U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3608	2824	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2824	836	regsvr32.exe	88
PID 836 wrote to memory of 2824	836	regsvr32.exe	88
PID 836 wrote to memory of 2824	836	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ab2dc29e5425bfa5395745be1d35f607.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ab2dc29e5425bfa5395745be1d35f607.dll
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 580
    3⤵
    - Program crash
    PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2824 -ip 2824
1⤵
PID:4436

memory/2824-0-0x0000000000720000-0x000000000075F000-memory.dmp

Filesize
252KB

Download