fc0b122219bce61e969d4f80afc2686e5e4c272f9ff207841fef35ed3a8bb900

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 06:03

Target

bdda00494b659523feb08c23d4d7f38e.dll
Size

82KB
MD5

bdda00494b659523feb08c23d4d7f38e
SHA1

378613ff0be3563f7778cd37235b88fab74cde95
SHA256

fc0b122219bce61e969d4f80afc2686e5e4c272f9ff207841fef35ed3a8bb900
SHA512

73c0df0ff8cb4909048659328871a4a35eb4cfb4d47ad4761c402a95e953299990040f4a7fe43773ebe06d2d8a96513939d8593dbc4e956aba837bf1ea396ecc
SSDEEP

1536:wGp0JyqoGGUEfpp20+IpinvoChqxdvKtpIOVQ1NVRGUJzC1sHsDcpB:zpkyqovi0CQCMxmCNVRGoTMDs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3176	4240	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4240	3296	regsvr32.exe	89
PID 3296 wrote to memory of 4240	3296	regsvr32.exe	89
PID 3296 wrote to memory of 4240	3296	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bdda00494b659523feb08c23d4d7f38e.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bdda00494b659523feb08c23d4d7f38e.dll
  2⤵
  PID:4240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 596
    3⤵
    - Program crash
    PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4240 -ip 4240
1⤵
PID:2916

memory/4240-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download