bd2709e7614b75b2748ddd1ec0f4d6e01ac99e9e3b321246e08a5149ce9027df

Analysis

Target
SecuriteInfo.com.Heur.Mint.Zard.52.1127.exe
Size 2.6MB
Sample220620-t6h2vafadn
SHA256 bd2709e7614b75b2748ddd1ec0f4d6e01ac99e9e3b321246e08a5149ce9027df
MD5 6ffbcef7b5ff3775611da1fe65f81cdc
SHA1 42e74d2a0fc4fa6dfc515d71530e0e103419a454
SHA512 f1a7bd458c527f8c3009b9261d60a16c16e47a501664c13469593a2a7bbda8fe5c5591eae24975b93ced0a9274e61ea31efb32a9e478bf1c2a93dbe7eea4270d
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	1928	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1928	1276	regsvr32.exe	27
PID 1276 wrote to memory of 1928	1276	regsvr32.exe	27
PID 1276 wrote to memory of 1928	1276	regsvr32.exe	27
PID 1276 wrote to memory of 1928	1276	regsvr32.exe	27
PID 1276 wrote to memory of 1928	1276	regsvr32.exe	27
PID 1276 wrote to memory of 1928	1276	regsvr32.exe	27
PID 1276 wrote to memory of 1928	1276	regsvr32.exe	27
PID 1928 wrote to memory of 1536	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1536	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1536	1928	regsvr32.exe	28
PID 1928 wrote to memory of 1536	1928	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.Mint.Zard.52.1127.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heur.Mint.Zard.52.1127.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 296
    3⤵
    - Program crash
    PID:1536

memory/1276-54-0x000007FEFBC21000-0x000007FEFBC23000-memory.dmp

Download

memory/1928-56-0x00000000756E1000-0x00000000756E3000-memory.dmp

Download