dcf3488e65a158ebcef3364f26db2b50d1ad8113193bdbf8c3878f0e5f35238e

Analysis

max time kernel
168s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 14:20

Target

dcf3488e65a158ebcef3364f26db2b50d1ad8113193bdbf8c3878f0e5f35238e.exe
Size

312KB
MD5

ebd31422095ff3d059b06981a7306bc6
SHA1

84059130fbefcddb6d28f0b0211937c93c686f38
SHA256

dcf3488e65a158ebcef3364f26db2b50d1ad8113193bdbf8c3878f0e5f35238e
SHA512

279328580e3e715f79852cc7d78418d94e4946b212ad1c8d7915eb133fcce6b1ba52093f86eee7dea598c0ab196d6f5d2842fc0df32291651c7dc9ce870292d2
SSDEEP

6144:AEPDl+AqiL7zw42e+N53ckJvEn+EV0VBFXBqZsfiX:AE7d3/srNtXEm3RsTX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	2420	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 2420	4104	regsvr32.exe	80
PID 4104 wrote to memory of 2420	4104	regsvr32.exe	80
PID 4104 wrote to memory of 2420	4104	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\dcf3488e65a158ebcef3364f26db2b50d1ad8113193bdbf8c3878f0e5f35238e.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\dcf3488e65a158ebcef3364f26db2b50d1ad8113193bdbf8c3878f0e5f35238e.exe
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 600
    3⤵
    - Program crash
    PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2420 -ip 2420
1⤵
PID:664