c56c37bd40d82039b4f9b0fbf3a4c182504ce65f404732c010eca68245f27f78

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 21:09

Target

b8321be0656eb835fe44dda2ecd37163.dll
Size

80KB
MD5

b8321be0656eb835fe44dda2ecd37163
SHA1

521def101e3ed758066498a51f0d4ceb60024ab6
SHA256

c56c37bd40d82039b4f9b0fbf3a4c182504ce65f404732c010eca68245f27f78
SHA512

1f4eb49d45b2409362babff5cb12ca4c94f73c4d0d770ea2f6f6b59b0bf55678ce35b43704cd1df826bd882f928b89c96b9fd0feb008e69847d2f9e47dcc753a
SSDEEP

1536:t1zQtgy/Bjk9HV8Yz50QxzqIgqDO+FdO3FjiOCIBK3bvl4bG0DS3:t1Ik916QxzvOyCFjTCpj2Gj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	4868	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 4868	1156	regsvr32.exe	89
PID 1156 wrote to memory of 4868	1156	regsvr32.exe	89
PID 1156 wrote to memory of 4868	1156	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b8321be0656eb835fe44dda2ecd37163.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\b8321be0656eb835fe44dda2ecd37163.dll
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 596
    3⤵
    - Program crash
    PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4868 -ip 4868
1⤵
PID:1576

memory/4868-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download