5f3c1ddebfe870a5a16bc51c3dca531828aba7689221a883a1648fc74638906c

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 14:08

Target

5f3c1ddebfe870a5a16bc51c3dca531828aba7689221a883a1648fc74638906c.exe
Size

68KB
MD5

7e0adcd167b2d670cf7457ff8db5701a
SHA1

3273407a14916a8dd96b5707480289e634675083
SHA256

5f3c1ddebfe870a5a16bc51c3dca531828aba7689221a883a1648fc74638906c
SHA512

3e09798f05c9555dce042779bf322278882bad46c931227d7ffdba9356a180c1017897c92e1ef985c30234d44a9db8a7fabaa202c1e209eb19da88c56da1f809
SSDEEP

1536:gmbKB6pbMt5B6WsE+br2yxOggQFP5sJazV1Xn9aQLBvsG:g8pbu54WspfJkgBsJavXncCBv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1812	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1812	364	regsvr32.exe	26
PID 364 wrote to memory of 1812	364	regsvr32.exe	26
PID 364 wrote to memory of 1812	364	regsvr32.exe	26
PID 364 wrote to memory of 1812	364	regsvr32.exe	26
PID 364 wrote to memory of 1812	364	regsvr32.exe	26
PID 364 wrote to memory of 1812	364	regsvr32.exe	26
PID 364 wrote to memory of 1812	364	regsvr32.exe	26
PID 1812 wrote to memory of 1948	1812	regsvr32.exe	27
PID 1812 wrote to memory of 1948	1812	regsvr32.exe	27
PID 1812 wrote to memory of 1948	1812	regsvr32.exe	27
PID 1812 wrote to memory of 1948	1812	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5f3c1ddebfe870a5a16bc51c3dca531828aba7689221a883a1648fc74638906c.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5f3c1ddebfe870a5a16bc51c3dca531828aba7689221a883a1648fc74638906c.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 296
    3⤵
    - Program crash
    PID:1948

memory/364-54-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

Filesize
8KB

Download
memory/1812-55-0x0000000000000000-mapping.dmp

Download
memory/1812-56-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1948-57-0x0000000000000000-mapping.dmp

Download