feac915848013dfd8fb280f9554488704b1e85fcd5d2a4df9ef8085b279c4d33

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 22:17

Target
af9b882804792d2f52fe9b1906c7259e.dll
Size 94KB
Sample240229-17tnasee64
SHA256 feac915848013dfd8fb280f9554488704b1e85fcd5d2a4df9ef8085b279c4d33
MD5 af9b882804792d2f52fe9b1906c7259e
SHA1 ca0fb5ce56ba6c49c237cc16647f4cbba98ed0b1
SHA512 704b675756ee74ee48b15b367602036b5288c0f9517fd4db80986cdb6493ff0401d7b1df637494010c2d5d60bf165e566a52fc5644a2987f4ddb6f11ceb7a19f
SSDEEP 1536:p8Dapv503stQ/qUla37UoVEiGGinsflUqf9vj7NvOHwxAYVdbvyu/igJ:fp0uwg37pisflUqPFxAY/iu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	1264	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1264	1584	regsvr32.exe	86
PID 1584 wrote to memory of 1264	1584	regsvr32.exe	86
PID 1584 wrote to memory of 1264	1584	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\af9b882804792d2f52fe9b1906c7259e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\af9b882804792d2f52fe9b1906c7259e.dll
  2⤵
  PID:1264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 604
    3⤵
    - Program crash
    PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1264 -ip 1264
1⤵
PID:452

memory/1264-0-0x0000000010000000-0x000000001005B000-memory.dmp

Download

memory/1264-1-0x0000000010000000-0x000000001005B000-memory.dmp

Download