4883c1220532dc7436d23cbd760c31b6c84b8e956767d5e0a4c75e64a202f289

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:15

Target

4883c1220532dc7436d23cbd760c31b6c84b8e956767d5e0a4c75e64a202f289.exe
Size

107KB
MD5

0afa4074570ed3dea822ba48f3601d07
SHA1

fbf81cd3f53b82be77ac954eaadcf1e3322cd2fb
SHA256

4883c1220532dc7436d23cbd760c31b6c84b8e956767d5e0a4c75e64a202f289
SHA512

ae0a3f7c5212231b6c254a9cf010af40ddfc938284050c172bcb912add85b9b0a1a41f191cd86dfb9d4af93594f1282ad1d710de22904333bafc35d20674a9dc
SSDEEP

3072:REhLjK/6CnK4cT6HKBmg0crZA2fdmpmt8mfp:WjKdcWvcri2fdKW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1224 1676 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
1224	1676	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 2244 wrote to memory of 1676	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 1676	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 1676	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 1676	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 1676	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 1676	2244	regsvr32.exe	regsvr32.exe
PID 2244 wrote to memory of 1676	2244	regsvr32.exe	regsvr32.exe
PID 1676 wrote to memory of 1224	1676	regsvr32.exe	WerFault.exe
PID 1676 wrote to memory of 1224	1676	regsvr32.exe	WerFault.exe
PID 1676 wrote to memory of 1224	1676	regsvr32.exe	WerFault.exe
PID 1676 wrote to memory of 1224	1676	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4883c1220532dc7436d23cbd760c31b6c84b8e956767d5e0a4c75e64a202f289.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4883c1220532dc7436d23cbd760c31b6c84b8e956767d5e0a4c75e64a202f289.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 296
    3⤵
    - Program crash
    PID:1224