e4015a273df75eb0f36c08939283889ce92767c3c5647922bbabeab2498f156e | Triage

Analysis

max time kernel
93s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 16:32

Sharing

Report Analysis Logs

General

Target

ac573753daa689ba2f667e4039639367.exe
Size

332KB
MD5

ac573753daa689ba2f667e4039639367
SHA1

bf51404334d4476f7e323a0c058332c6c0c8c011
SHA256

e4015a273df75eb0f36c08939283889ce92767c3c5647922bbabeab2498f156e
SHA512

b0df2c12325ade35c42a6e87d44599b3c7956b628284133a5832ad12b6a8c4479cc2b42c8bcc1ae7ed50ef904e1f2d3038fd8ced51287e3b03d379ec2e308adf
SSDEEP

6144:ObXY9WFVcPsz06+cX/kX2Rp0oRqA/6on+yNUvpTXT:mYQFV7MQV6kOp

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4996	116	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 116	4404	regsvr32.exe	88
PID 4404 wrote to memory of 116	4404	regsvr32.exe	88
PID 4404 wrote to memory of 116	4404	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ac573753daa689ba2f667e4039639367.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ac573753daa689ba2f667e4039639367.exe
  2⤵
  PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 600
    3⤵
    - Program crash
    PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 116 -ip 116
1⤵
PID:1164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads