f2f25a87a3214c0b3e46a8001441eb331cbee1b23183da433fad4e00e27b287b

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 11:43

Target

cdfa76332afb98736b33d77d8b87f4b8.dll
Size

86KB
MD5

cdfa76332afb98736b33d77d8b87f4b8
SHA1

f8367b0fb112db81f30e65d470afdf1107ba15be
SHA256

f2f25a87a3214c0b3e46a8001441eb331cbee1b23183da433fad4e00e27b287b
SHA512

47a7ec3611e09c234068853ea9125b7b39547d8b74a8350e9f314f4331b96d94c9036e81dad09600117189a261087c98f15cd2c756a424c5fbf0bb87660e8be5
SSDEEP

1536:GH7bVwEkvjb2GB3CJabZhniC+jfsz4rbaZo5lXoUn/Bn8xg5iWqUo/KjfCYLKsar:GTkvjSLJabZWjfszUbt//B8xd99aOmxO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	2768	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 2768	4408	regsvr32.exe	90
PID 4408 wrote to memory of 2768	4408	regsvr32.exe	90
PID 4408 wrote to memory of 2768	4408	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\cdfa76332afb98736b33d77d8b87f4b8.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\cdfa76332afb98736b33d77d8b87f4b8.dll
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 596
    3⤵
    - Program crash
    PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2768 -ip 2768
1⤵
PID:1600

memory/2768-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download