6c5bc0f2b30bc4194931e9d0b72b43972ff5e7b0ea459f4ae01a9023000e78b5

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 03:56

Target

bfc8a9009442d4a345f7be53280f27b1.dll
Size

140KB
MD5

bfc8a9009442d4a345f7be53280f27b1
SHA1

654475a6b58fcc4253717f82646807660a260a22
SHA256

6c5bc0f2b30bc4194931e9d0b72b43972ff5e7b0ea459f4ae01a9023000e78b5
SHA512

0053a850bc3aac2b0fdd118ecb138dcc47d6e7de79c225c050382c84d10406f83d99f4d8054688488422097a0e4863d090bfb2b1fc9c6646f484f8de979ea67c
SSDEEP

1536:GmS/H46R4Nslh6AzHHlRPF0h8k79Pl5E0HW6eH/o8QkP:Wzy4YAzlRPFidkPosP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4312	552	WerFault.exe	96

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 552	5104	regsvr32.exe	96
PID 5104 wrote to memory of 552	5104	regsvr32.exe	96
PID 5104 wrote to memory of 552	5104	regsvr32.exe	96

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bfc8a9009442d4a345f7be53280f27b1.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bfc8a9009442d4a345f7be53280f27b1.dll
  2⤵
  PID:552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 596
    3⤵
    - Program crash
    PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 552 -ip 552
1⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4380

memory/552-0-0x00000000020F0000-0x000000000212E000-memory.dmp

Filesize
248KB

Download
memory/552-1-0x00000000020F0000-0x000000000212E000-memory.dmp

Filesize
248KB

Download