884b1a57759cba5cd4b2eab1c0253ae8cbbc2ea449beaa6ea84bf40b0afee4d9

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:59

Target

884b1a57759cba5cd4b2eab1c0253ae8cbbc2ea449beaa6ea84bf40b0afee4d9.exe
Size

107KB
MD5

e42cd67efe223b6c5b2878a4dfe3e2da
SHA1

b92e4493248ae132e569555aaecb5dbf34ae26ac
SHA256

884b1a57759cba5cd4b2eab1c0253ae8cbbc2ea449beaa6ea84bf40b0afee4d9
SHA512

93b34c0ca5037398a74d7dba2e4d12b6783868ce3221c5b61d345a985aeaa6d53dfc6589c828fa0531b77ed106f2735441ebfbdb5ab54cab6478ccfe29e67603
SSDEEP

3072:REhLjKU6CnK4cT6HKBmg0crZA2fdmpmtJmfp:WjKucWvcri2fdKL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1752 2088 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
1752	2088	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	regsvr32.exe
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	regsvr32.exe
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	regsvr32.exe
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	regsvr32.exe
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	regsvr32.exe
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	regsvr32.exe
PID 1856 wrote to memory of 2088	1856	regsvr32.exe	regsvr32.exe
PID 2088 wrote to memory of 1752	2088	regsvr32.exe	WerFault.exe
PID 2088 wrote to memory of 1752	2088	regsvr32.exe	WerFault.exe
PID 2088 wrote to memory of 1752	2088	regsvr32.exe	WerFault.exe
PID 2088 wrote to memory of 1752	2088	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\884b1a57759cba5cd4b2eab1c0253ae8cbbc2ea449beaa6ea84bf40b0afee4d9.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\884b1a57759cba5cd4b2eab1c0253ae8cbbc2ea449beaa6ea84bf40b0afee4d9.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 292
3⤵
- Program crash
PID:1752