5f3c1ddebfe870a5a16bc51c3dca531828aba7689221a883a1648fc74638906c

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 14:08

Target

5f3c1ddebfe870a5a16bc51c3dca531828aba7689221a883a1648fc74638906c.exe
Size

68KB
MD5

7e0adcd167b2d670cf7457ff8db5701a
SHA1

3273407a14916a8dd96b5707480289e634675083
SHA256

5f3c1ddebfe870a5a16bc51c3dca531828aba7689221a883a1648fc74638906c
SHA512

3e09798f05c9555dce042779bf322278882bad46c931227d7ffdba9356a180c1017897c92e1ef985c30234d44a9db8a7fabaa202c1e209eb19da88c56da1f809
SSDEEP

1536:gmbKB6pbMt5B6WsE+br2yxOggQFP5sJazV1Xn9aQLBvsG:g8pbu54WspfJkgBsJavXncCBv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4920	4152	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 4152	1404	regsvr32.exe	80
PID 1404 wrote to memory of 4152	1404	regsvr32.exe	80
PID 1404 wrote to memory of 4152	1404	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5f3c1ddebfe870a5a16bc51c3dca531828aba7689221a883a1648fc74638906c.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5f3c1ddebfe870a5a16bc51c3dca531828aba7689221a883a1648fc74638906c.exe
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 600
    3⤵
    - Program crash
    PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4152 -ip 4152
1⤵
PID:3396