61ccb6e9c0a7d7377fa64bf31114e55aa3e8232a84cc520ba60e7e65bb43bd31

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 22:19

Target

61ccb6e9c0a7d7377fa64bf31114e55aa3e8232a84cc520ba60e7e65bb43bd31.dll
Size

454KB
MD5

4c73af70c1c54b55973adcfedc031342
SHA1

e50ca319857e5328bc3ba952796d097f614ea8ef
SHA256

61ccb6e9c0a7d7377fa64bf31114e55aa3e8232a84cc520ba60e7e65bb43bd31
SHA512

158c03b8f4a86bc9817d5f71d7bd6a088b6ecca488fea2c5656db9d089cd005eeaa47ce1d0569b3a2e16a00f27a93630bb8204fee2e19952cb7dc9b5d20b1ad1
SSDEEP

12288:2q1ppozb1b26o3MjKHtVtzsyRmJ0F2I1jnWlYLVFoNfO0:L1ppoVJo8atVJsyRmXIgYL/I20

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
712	964	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 964	3372	regsvr32.exe	92
PID 3372 wrote to memory of 964	3372	regsvr32.exe	92
PID 3372 wrote to memory of 964	3372	regsvr32.exe	92

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\61ccb6e9c0a7d7377fa64bf31114e55aa3e8232a84cc520ba60e7e65bb43bd31.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\61ccb6e9c0a7d7377fa64bf31114e55aa3e8232a84cc520ba60e7e65bb43bd31.dll
  2⤵
  PID:964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 620
    3⤵
    - Program crash
    PID:712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 964 -ip 964
1⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3832 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:560