b61a944ae61900b6541a8dda90471a58ed482dadd7e03a3dde536c4f7c8b9cda

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 11:02

Target

bb1a08021adce61d8b87a38b2e112519.dll
Size

85KB
MD5

bb1a08021adce61d8b87a38b2e112519
SHA1

62962d699625c3f2b30f1f5f736a522118c4e301
SHA256

b61a944ae61900b6541a8dda90471a58ed482dadd7e03a3dde536c4f7c8b9cda
SHA512

7c178dac4bc7e783b747f9e73dd646ca7aee984fb9ab85f404c46fe01e067320c3e143b61b3ee2cb68072bb8ad87c8a84a33ad7a9ac63a8943c5672d1dc4ffde
SSDEEP

1536:6DSf9qLRiLN0tXi0ftLRwxma5XMKET9ioq58BqFT+5YHbm379graofJxmV:6K9eiLNQvwwaGwFT+5f2+6JwV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1844	2984	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 2984	3188	regsvr32.exe	89
PID 3188 wrote to memory of 2984	3188	regsvr32.exe	89
PID 3188 wrote to memory of 2984	3188	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bb1a08021adce61d8b87a38b2e112519.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bb1a08021adce61d8b87a38b2e112519.dll
  2⤵
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 596
    3⤵
    - Program crash
    PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2984 -ip 2984
1⤵
PID:2368

memory/2984-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download