a70d348b4729cf13f43cdaead5fd3099a0256345199f600ea17234322e986417

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 10:37

Target

b47ea0c323660bcdf677c382774293d8.dll
Size

86KB
MD5

b47ea0c323660bcdf677c382774293d8
SHA1

2e064be02bf803bc5e03461640cbe28c652d6765
SHA256

a70d348b4729cf13f43cdaead5fd3099a0256345199f600ea17234322e986417
SHA512

37a2175ff1fc5e5ecc2fb43ae94570a2cc6829915a00495a661de23556640b5defca836274e57c66c7e7e0f796593dc47e35c9d53a89ca6ec148f03c0adb18a8
SSDEEP

1536:hKsdoHt1bs1xkzc4Z+8jHtB216+cjLPB8lzNQSb0wG:hKsdoHt1byxWrjHj2kt35AQSa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	1508	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1508	4844	regsvr32.exe	89
PID 4844 wrote to memory of 1508	4844	regsvr32.exe	89
PID 4844 wrote to memory of 1508	4844	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b47ea0c323660bcdf677c382774293d8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b47ea0c323660bcdf677c382774293d8.dll
  2⤵
  PID:1508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 596
    3⤵
    - Program crash
    PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1508 -ip 1508
1⤵
PID:3392

memory/1508-0-0x00000000006A0000-0x00000000006E3000-memory.dmp

Filesize
268KB

Download