0433300d63b596e0c3124eee761470fa984b80f0247d29c3f322d03581ca99c7

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 11:35

Target

cdf65f9ee46313602e658cea26d4b9db.dll
Size

82KB
MD5

cdf65f9ee46313602e658cea26d4b9db
SHA1

067a816a5b56920e2b929d014d5cc8204ec071a0
SHA256

0433300d63b596e0c3124eee761470fa984b80f0247d29c3f322d03581ca99c7
SHA512

ebe57acaa3725da9bf6ba16b7066b44c936ef70aa896f1a06a6b20fcd8e77bf217678626d78884400fadaaeb429ae01fb812fd8239075ed7b0e8dff6bfc725f3
SSDEEP

1536:fngwz66Zc91e10sp5EeVQ6ZbLPz8ikCNelkKAwH274Eq8yk:fnbP5EeVQqbLr8R9AwHYM8yk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1504	4712	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4712	4772	regsvr32.exe	87
PID 4772 wrote to memory of 4712	4772	regsvr32.exe	87
PID 4772 wrote to memory of 4712	4772	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cdf65f9ee46313602e658cea26d4b9db.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cdf65f9ee46313602e658cea26d4b9db.dll
  2⤵
  PID:4712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 588
    3⤵
    - Program crash
    PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4712 -ip 4712
1⤵
PID:3984

memory/4712-0-0x0000000000770000-0x00000000007AE000-memory.dmp

Filesize
248KB

Download
memory/4712-1-0x0000000000770000-0x00000000007AE000-memory.dmp

Filesize
248KB

Download