a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 11:25

Target

a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a.exe
Size

411KB
MD5

288026f34487b267ec993c1a6b201648
SHA1

ec8cc19622de6c19e37bfe50a586f5c159dcf258
SHA256

a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a
SHA512

d44f39c078e7569643558d6a49cb85c11c08c916cb483c6e4177bd9ffcbeb898e509f5008f5f5efbba62792424a5c4196937edb7b4a26cc60b86d79523a9e5b6
SSDEEP

12288:fzf6rCCz5D1kHNjo4SHe777777777777777777WIPLmAyu9P:LSFz5RMN0THE4UP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	2292	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2292	2700	regsvr32.exe	28
PID 2700 wrote to memory of 2292	2700	regsvr32.exe	28
PID 2700 wrote to memory of 2292	2700	regsvr32.exe	28
PID 2700 wrote to memory of 2292	2700	regsvr32.exe	28
PID 2700 wrote to memory of 2292	2700	regsvr32.exe	28
PID 2700 wrote to memory of 2292	2700	regsvr32.exe	28
PID 2700 wrote to memory of 2292	2700	regsvr32.exe	28
PID 2292 wrote to memory of 1312	2292	regsvr32.exe	29
PID 2292 wrote to memory of 1312	2292	regsvr32.exe	29
PID 2292 wrote to memory of 1312	2292	regsvr32.exe	29
PID 2292 wrote to memory of 1312	2292	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 296
    3⤵
    - Program crash
    PID:1312

memory/2292-0-0x0000000001B30000-0x0000000001B97000-memory.dmp

Filesize
412KB

Download