a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 11:25

Target

a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a.exe
Size

411KB
MD5

288026f34487b267ec993c1a6b201648
SHA1

ec8cc19622de6c19e37bfe50a586f5c159dcf258
SHA256

a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a
SHA512

d44f39c078e7569643558d6a49cb85c11c08c916cb483c6e4177bd9ffcbeb898e509f5008f5f5efbba62792424a5c4196937edb7b4a26cc60b86d79523a9e5b6
SSDEEP

12288:fzf6rCCz5D1kHNjo4SHe777777777777777777WIPLmAyu9P:LSFz5RMN0THE4UP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4924	3200	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 3200	3024	regsvr32.exe	82
PID 3024 wrote to memory of 3200	3024	regsvr32.exe	82
PID 3024 wrote to memory of 3200	3024	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a.exe
  2⤵
  PID:3200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 600
    3⤵
    - Program crash
    PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3200 -ip 3200
1⤵
PID:980

memory/3200-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download