8bce2c9062704dddd72abb881309bb20fdfbc1e76f8ed9142570c01131a70c38

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 07:23

Target
c02f386e43f9544ccd80e370fc462324.dll
Size 33KB
Sample240311-h73bbsfc8v
SHA256 8bce2c9062704dddd72abb881309bb20fdfbc1e76f8ed9142570c01131a70c38
MD5 c02f386e43f9544ccd80e370fc462324
SHA1 a91a5f7f44fe389a615451365b082c9bae931864
SHA512 2d1d4f3ed86e58f4c14bdb01b78d640dc61bbdf442e9b0c2484b177a97e0c831715e80a9e5a3362f280de6072554c5b02156aba487b094e75f1eb58e899dfc1c
SSDEEP 768:DpL4LHXaFxzb9NbZD6qoobQYAXQR6MFIxxha5I:wX8xv/ZOebrZRNFMd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3340	4612	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4612	2376	regsvr32.exe	94
PID 2376 wrote to memory of 4612	2376	regsvr32.exe	94
PID 2376 wrote to memory of 4612	2376	regsvr32.exe	94

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c02f386e43f9544ccd80e370fc462324.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c02f386e43f9544ccd80e370fc462324.dll
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 640
    3⤵
    - Program crash
    PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4612 -ip 4612
1⤵
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8
1⤵
PID:2908

memory/4612-0-0x0000000010000000-0x000000001003C000-memory.dmp

Download