7d428010c5cd53c74a10667beb3588417ddbbf44e3d956c777078ba17599105b

Analysis

max time kernel
97s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 17:22

Target

c6733a727781a495c416cd5a6c4bfae2.dll
Size

82KB
MD5

c6733a727781a495c416cd5a6c4bfae2
SHA1

379a2c041d68d6459e29788064918925af7dd72e
SHA256

7d428010c5cd53c74a10667beb3588417ddbbf44e3d956c777078ba17599105b
SHA512

dbddec33bf8114c26e349f37beecf9eec7eb14bfe5b0a4036c7cddd6f6adc1b773f26b9884b8eed9ba8a7f753d33fbc18c4177dd16b00e2b420b8d734ffbd8d1
SSDEEP

1536:KM6PGkmFJxwVuEIZdWbEFyaD/fcUCQ8/I8sxmkcIUbh0Q0rsVv0IN8bEFa:v6PGkmFJxyuEIZsOVcU18S1dUFBoA08e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2148	2760	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 2760	3948	regsvr32.exe	85
PID 3948 wrote to memory of 2760	3948	regsvr32.exe	85
PID 3948 wrote to memory of 2760	3948	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c6733a727781a495c416cd5a6c4bfae2.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\c6733a727781a495c416cd5a6c4bfae2.dll
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 596
    3⤵
    - Program crash
    PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2760 -ip 2760
1⤵
PID:2548

memory/2760-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download