daa0895e470daf68eedaa965ebb465e13a9025c62285b10db6313003b892917e

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 20:04

Target

e23ae25fa01a8cf4113a6462d1ac9513.dll
Size

89KB
MD5

e23ae25fa01a8cf4113a6462d1ac9513
SHA1

ea4efd6c4c2b2484a6898d5ee9d2ddcb5b9ef64c
SHA256

daa0895e470daf68eedaa965ebb465e13a9025c62285b10db6313003b892917e
SHA512

5a588740197d13680cb10e5115ff0a261949424e0dbb6446abe95412cca8f7abf576a81eb6061fb40f2a59b890697f77003833d66343f02fe18c05243c0fac61
SSDEEP

1536:uS4C3THfovpQybiCHfkwPQrmRdbrj/9hSbfnlRDJBzkoCRRuLD572svdcOPg:Px3THQvp11f+kdHzDqlt3k3SLl7Fv+V

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3372	1308	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1308	1084	regsvr32.exe	83
PID 1084 wrote to memory of 1308	1084	regsvr32.exe	83
PID 1084 wrote to memory of 1308	1084	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e23ae25fa01a8cf4113a6462d1ac9513.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e23ae25fa01a8cf4113a6462d1ac9513.dll
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 596
    3⤵
    - Program crash
    PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1308 -ip 1308
1⤵
PID:232

memory/1308-0-0x0000000000980000-0x00000000009C4000-memory.dmp

Filesize
272KB

Download