5c28b949507a6330ec9e768251131e823e1ed1587b5e8913c9e70009f235e9bb

Analysis

max time kernel
45s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:04

Target

base/RegisterInstallStart.exe
Size

7KB
MD5

79b26d6c53a451c96454bcee611350bd
SHA1

7975573dcf8654d954b21601474dad433905093b
SHA256

d5d24d8e0fe89d082881966bd5e03a6a784a8db8c5b05c47dd6b512c37466e7b
SHA512

75669c2b56f4c0ad03eb7d98e3ac4aa7ae4f93e1e18777a01651468eed78e976e06ece555f91e58c0ce300c73cf76af19d8f0b2d53d016473cf9c3d9e2cf44ce
SSDEEP

96:A3bKpIrljiVFzlJnKpvlyxPMoaR2zNnVkFDvIikTZN0ADrzBUWZwiW4dzzNt:ebSIrNiVdlkpvwhMNRlxv8L0QzBUW+W

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

668 1128 WerFault.exe RegisterInstallStart.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegisterInstallStart.exe

pid process

1128 RegisterInstallStart.exe
1128 RegisterInstallStart.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegisterInstallStart.exe

description pid process

Token: SeDebugPrivilege 1128 RegisterInstallStart.exe

pid	pid_target	process	target process
668	1128	WerFault.exe	RegisterInstallStart.exe

pid	process
1128	RegisterInstallStart.exe
1128	RegisterInstallStart.exe

description	pid	process
Token: SeDebugPrivilege	1128	RegisterInstallStart.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

RegisterInstallStart.exe

description	pid	process	target process
PID 1128 wrote to memory of 668	1128	RegisterInstallStart.exe	WerFault.exe
PID 1128 wrote to memory of 668	1128	RegisterInstallStart.exe	WerFault.exe
PID 1128 wrote to memory of 668	1128	RegisterInstallStart.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\base\RegisterInstallStart.exe
"C:\Users\Admin\AppData\Local\Temp\base\RegisterInstallStart.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1128 -s 1144
  2⤵
  - Program crash
  PID:668

memory/668-57-0x0000000000000000-mapping.dmp

Download
memory/1128-54-0x0000000000D50000-0x0000000000D58000-memory.dmp

Filesize
32KB

Download
memory/1128-55-0x0000000000560000-0x0000000000574000-memory.dmp

Filesize
80KB

Download
memory/1128-56-0x00000000008D0000-0x0000000000938000-memory.dmp

Filesize
416KB

Download