e4015a273df75eb0f36c08939283889ce92767c3c5647922bbabeab2498f156e

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 16:32

Target

ac573753daa689ba2f667e4039639367.exe
Size

332KB
MD5

ac573753daa689ba2f667e4039639367
SHA1

bf51404334d4476f7e323a0c058332c6c0c8c011
SHA256

e4015a273df75eb0f36c08939283889ce92767c3c5647922bbabeab2498f156e
SHA512

b0df2c12325ade35c42a6e87d44599b3c7956b628284133a5832ad12b6a8c4479cc2b42c8bcc1ae7ed50ef904e1f2d3038fd8ced51287e3b03d379ec2e308adf
SSDEEP

6144:ObXY9WFVcPsz06+cX/kX2Rp0oRqA/6on+yNUvpTXT:mYQFV7MQV6kOp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2148	1072	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1072	1692	regsvr32.exe	28
PID 1692 wrote to memory of 1072	1692	regsvr32.exe	28
PID 1692 wrote to memory of 1072	1692	regsvr32.exe	28
PID 1692 wrote to memory of 1072	1692	regsvr32.exe	28
PID 1692 wrote to memory of 1072	1692	regsvr32.exe	28
PID 1692 wrote to memory of 1072	1692	regsvr32.exe	28
PID 1692 wrote to memory of 1072	1692	regsvr32.exe	28
PID 1072 wrote to memory of 2148	1072	regsvr32.exe	29
PID 1072 wrote to memory of 2148	1072	regsvr32.exe	29
PID 1072 wrote to memory of 2148	1072	regsvr32.exe	29
PID 1072 wrote to memory of 2148	1072	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac573753daa689ba2f667e4039639367.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ac573753daa689ba2f667e4039639367.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 296
    3⤵
    - Program crash
    PID:2148