f95ce6245cbe9518ddeb894a949fbe2a2549e94a8195c764bbcfb00d06f9e335

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 23:44

Target

b5f54e1f5a81fc1535338f4639da92c8.dll
Size

152KB
MD5

b5f54e1f5a81fc1535338f4639da92c8
SHA1

a86eaa9c724b02d41b833ad5260710418d4af0e1
SHA256

f95ce6245cbe9518ddeb894a949fbe2a2549e94a8195c764bbcfb00d06f9e335
SHA512

eeca429608ffca8e258af55a82ac2a8e198c33d9bc589a80183102541c215246a552ce6d4adce393496ea322aa3313c9a6fd57cff4fd052264ea73c59ad417bc
SSDEEP

3072:aS4KxuCJUZkvM7nGrzoOYVBHXOnTTBftSyU/nPU9VC:FfTUZvGrkOYVlOnTTBltU/nPU9VC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	2320	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2320	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2320	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2320	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2320	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2320	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2320	2180	regsvr32.exe	28
PID 2180 wrote to memory of 2320	2180	regsvr32.exe	28
PID 2320 wrote to memory of 2860	2320	regsvr32.exe	29
PID 2320 wrote to memory of 2860	2320	regsvr32.exe	29
PID 2320 wrote to memory of 2860	2320	regsvr32.exe	29
PID 2320 wrote to memory of 2860	2320	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b5f54e1f5a81fc1535338f4639da92c8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b5f54e1f5a81fc1535338f4639da92c8.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 304
    3⤵
    - Program crash
    PID:2860