2e589790c8bbb26ad9d03e3e240e8782c111affae8abd52ad234fe0c8f91a1fb

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:07

Target

f9495e968f9a1610c0cf9383053e5b5696ecc85ca3ca2a338c24c7204cc93881.dll
Size

244KB
MD5

df1b0f2d8e1c9ff27a9b0eb50d0967ef
SHA1

fdd07c89c8ed656964dfa1a6cff271e170eda0c2
SHA256

f9495e968f9a1610c0cf9383053e5b5696ecc85ca3ca2a338c24c7204cc93881
SHA512

1310c467da1c30e1693b459102308e07aa755bec61423ae1e5a48b8313ebd24ff411b790f26b591b19d815e247d2c504f864fd73f9e0fd0bbb17917278f16d9a
SSDEEP

3072:Um/5nor0i+jZfh7vFiTR8MpFdieXF7A9JhCS8QHlliVY7c7LzOKA1cZrPx4N4t:vM8j0z7AlE7GrIZ4NQ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2300 1684 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
2300	1684	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2912 wrote to memory of 1684	2912	regsvr32.exe	regsvr32.exe
PID 2912 wrote to memory of 1684	2912	regsvr32.exe	regsvr32.exe
PID 2912 wrote to memory of 1684	2912	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f9495e968f9a1610c0cf9383053e5b5696ecc85ca3ca2a338c24c7204cc93881.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\f9495e968f9a1610c0cf9383053e5b5696ecc85ca3ca2a338c24c7204cc93881.dll
2⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 596
3⤵
- Program crash
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1684 -ip 1684
1⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2712 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:1428