330294d664248f9cc459917a297ad570f193425b75e1f4687bdcc959772698b0

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 05:14

Target

ba9ac609b53250b74000dc97ff12d443.dll
Size

84KB
MD5

ba9ac609b53250b74000dc97ff12d443
SHA1

bc54c9d066e156dd76b0f1f75cd2e2ac45be090f
SHA256

330294d664248f9cc459917a297ad570f193425b75e1f4687bdcc959772698b0
SHA512

eb9caa0387b4069ce72aceb73de11c96ac3661a8ec6efd977ae002c92ea25e0e8c6dd12addaa3a1e8671c5730d4342567be2b534efc649a1276eb1dca70d5534
SSDEEP

1536:TSA7rT6c0L4SPsvfcYxlz1Aix1e56lnQ/55h2/FahpXB87c7:TPaAfcYfz1nne8nQ/5D20XBGc7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1104	636	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 636	3064	regsvr32.exe	93
PID 3064 wrote to memory of 636	3064	regsvr32.exe	93
PID 3064 wrote to memory of 636	3064	regsvr32.exe	93

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ba9ac609b53250b74000dc97ff12d443.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ba9ac609b53250b74000dc97ff12d443.dll
  2⤵
  PID:636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 596
    3⤵
    - Program crash
    PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 636 -ip 636
1⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:672

memory/636-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download