ea24ff6dfdbf391b2885e56e484b251cd8aa940104eac90c7a4509218da9954b

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 17:02

Target

cbf31ed11be083b2bd889cf7a960a129.dll
Size

89KB
MD5

cbf31ed11be083b2bd889cf7a960a129
SHA1

a0c1a4e2afe6b31645eb024391d85e9478dfe94f
SHA256

ea24ff6dfdbf391b2885e56e484b251cd8aa940104eac90c7a4509218da9954b
SHA512

4ea117a422a10a76e2791fe7613aceb352259ccef5129e6d0d6ed3bd3836f862198fd6ce7ba48b491c8baad3485435bdc760ad8f11846f3474c3f12b7c1a3dc9
SSDEEP

1536:FC1QNaO4cEjfSdsGQw+DXzcxDTF7rgg4YPlsGfN2k0TnLg/MIxn:o1CRGfSdsTzwprggzPlsG8DLA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
832	4980	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4980	4456	regsvr32.exe	93
PID 4456 wrote to memory of 4980	4456	regsvr32.exe	93
PID 4456 wrote to memory of 4980	4456	regsvr32.exe	93

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cbf31ed11be083b2bd889cf7a960a129.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cbf31ed11be083b2bd889cf7a960a129.dll
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 596
    3⤵
    - Program crash
    PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4980 -ip 4980
1⤵
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:3880

memory/4980-0-0x0000000000730000-0x0000000000774000-memory.dmp

Filesize
272KB

Download