ba2b6f640f8f48c074a60a5575145bf15c41c4f4ac29740774981d2a5e9cbe07

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-01-2024 09:38

Target

ba2b6f640f8f48c074a60a5575145bf15c41c4f4ac29740774981d2a5e9cbe07.exe
Size

403KB
MD5

fd43ae144a47d1f97eabfa5864e29abd
SHA1

10c604df4dc1d0a61c3078342bd7b0a579184b0f
SHA256

ba2b6f640f8f48c074a60a5575145bf15c41c4f4ac29740774981d2a5e9cbe07
SHA512

98c5171d600d559494ea87e77ba9bab231a78c3e2b2933ec689d10db02143acd7d3eb67fe8d5a8508ef806680e64493ac4573d6def3ca561ad2b195b108728b1
SSDEEP

12288:Xzf6rCCz5D16HNJo4SHe777777777777777777WIPjfdEP5vAn:DSFz5RWN2THMWPyn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	1048	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1048	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1048	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1048	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1048	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1048	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1048	2236	regsvr32.exe	28
PID 2236 wrote to memory of 1048	2236	regsvr32.exe	28
PID 1048 wrote to memory of 1312	1048	regsvr32.exe	29
PID 1048 wrote to memory of 1312	1048	regsvr32.exe	29
PID 1048 wrote to memory of 1312	1048	regsvr32.exe	29
PID 1048 wrote to memory of 1312	1048	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ba2b6f640f8f48c074a60a5575145bf15c41c4f4ac29740774981d2a5e9cbe07.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ba2b6f640f8f48c074a60a5575145bf15c41c4f4ac29740774981d2a5e9cbe07.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 296
    3⤵
    - Program crash
    PID:1312

memory/1048-0-0x0000000000170000-0x00000000001D5000-memory.dmp

Filesize
404KB

Download