49e67da7587b30b034e52cada8ed73b0f38bfae6ae50bfc2c7a4cfba0e21ccad

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 22:35

Target

c70605ce8aa0620b77bb67b622a07d86.dll
Size

83KB
MD5

c70605ce8aa0620b77bb67b622a07d86
SHA1

02fb9a6b611694cc9fcb36a2b04582dd5a846fbc
SHA256

49e67da7587b30b034e52cada8ed73b0f38bfae6ae50bfc2c7a4cfba0e21ccad
SHA512

ffe8a0d43bc5f301b2e5e469e03c67e7af30bb422aab09f78b7e68a57b67658fa95d7d6c34f15fb49781c72c619f672b1582818e9f8e13b4ac5699486cbb9785
SSDEEP

1536:++FSgGE0yk4OWwvPJU6bCmt6RC9BMRMOUdRPF0h8k79Pl5E0HW6JxqRvr2HZVuwI:TSodQhU6HUC9kUdRPFidkjvAZAa1Cx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3428	4504	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 4504	2612	regsvr32.exe	90
PID 2612 wrote to memory of 4504	2612	regsvr32.exe	90
PID 2612 wrote to memory of 4504	2612	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c70605ce8aa0620b77bb67b622a07d86.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c70605ce8aa0620b77bb67b622a07d86.dll
  2⤵
  PID:4504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 608
    3⤵
    - Program crash
    PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4504 -ip 4504
1⤵
PID:4016

memory/4504-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download