884b1a57759cba5cd4b2eab1c0253ae8cbbc2ea449beaa6ea84bf40b0afee4d9

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:59

Target

884b1a57759cba5cd4b2eab1c0253ae8cbbc2ea449beaa6ea84bf40b0afee4d9.exe
Size

107KB
MD5

e42cd67efe223b6c5b2878a4dfe3e2da
SHA1

b92e4493248ae132e569555aaecb5dbf34ae26ac
SHA256

884b1a57759cba5cd4b2eab1c0253ae8cbbc2ea449beaa6ea84bf40b0afee4d9
SHA512

93b34c0ca5037398a74d7dba2e4d12b6783868ce3221c5b61d345a985aeaa6d53dfc6589c828fa0531b77ed106f2735441ebfbdb5ab54cab6478ccfe29e67603
SSDEEP

3072:REhLjKU6CnK4cT6HKBmg0crZA2fdmpmtJmfp:WjKucWvcri2fdKL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3320 1524 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
3320	1524	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4444 wrote to memory of 1524	4444	regsvr32.exe	regsvr32.exe
PID 4444 wrote to memory of 1524	4444	regsvr32.exe	regsvr32.exe
PID 4444 wrote to memory of 1524	4444	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\884b1a57759cba5cd4b2eab1c0253ae8cbbc2ea449beaa6ea84bf40b0afee4d9.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\884b1a57759cba5cd4b2eab1c0253ae8cbbc2ea449beaa6ea84bf40b0afee4d9.exe
2⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 608
3⤵
- Program crash
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1524 -ip 1524
1⤵
PID:5008