4883c1220532dc7436d23cbd760c31b6c84b8e956767d5e0a4c75e64a202f289

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:15

Target

4883c1220532dc7436d23cbd760c31b6c84b8e956767d5e0a4c75e64a202f289.exe
Size

107KB
MD5

0afa4074570ed3dea822ba48f3601d07
SHA1

fbf81cd3f53b82be77ac954eaadcf1e3322cd2fb
SHA256

4883c1220532dc7436d23cbd760c31b6c84b8e956767d5e0a4c75e64a202f289
SHA512

ae0a3f7c5212231b6c254a9cf010af40ddfc938284050c172bcb912add85b9b0a1a41f191cd86dfb9d4af93594f1282ad1d710de22904333bafc35d20674a9dc
SSDEEP

3072:REhLjK/6CnK4cT6HKBmg0crZA2fdmpmt8mfp:WjKdcWvcri2fdKW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1832 2996 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
1832	2996	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2992 wrote to memory of 2996	2992	regsvr32.exe	regsvr32.exe
PID 2992 wrote to memory of 2996	2992	regsvr32.exe	regsvr32.exe
PID 2992 wrote to memory of 2996	2992	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4883c1220532dc7436d23cbd760c31b6c84b8e956767d5e0a4c75e64a202f289.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4883c1220532dc7436d23cbd760c31b6c84b8e956767d5e0a4c75e64a202f289.exe
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 600
    3⤵
    - Program crash
    PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2996 -ip 2996
1⤵
PID:1868