3a230670423729a8a172d5e66bb938378a90f39f3e97578a63f59a4c4e7a065c

Analysis

max time kernel
131s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:37

Target

3a230670423729a8a172d5e66bb938378a90f39f3e97578a63f59a4c4e7a065c.exe
Size

103KB
MD5

b50cb8af8ecfc0125586313a2abd7c99
SHA1

94fc5136357b19185e8eb02585b11f2c61f05e8b
SHA256

3a230670423729a8a172d5e66bb938378a90f39f3e97578a63f59a4c4e7a065c
SHA512

b829488ec14f96a0c851cf22fa694f817192c500349f2008d996948c9d72fe2cdebda81956838747126dfc18d9ef5adcf1f59748905afd6594769e5f41e1d6e1
SSDEEP

1536:VypIGWG+QumiEgC9961zYyhxysVeBc58bDEcC2JfpLMt:VypXX+BmfgWBc58bDO27Mt

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2544 100 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
2544	100	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4700 wrote to memory of 100	4700	regsvr32.exe	regsvr32.exe
PID 4700 wrote to memory of 100	4700	regsvr32.exe	regsvr32.exe
PID 4700 wrote to memory of 100	4700	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3a230670423729a8a172d5e66bb938378a90f39f3e97578a63f59a4c4e7a065c.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4700

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3a230670423729a8a172d5e66bb938378a90f39f3e97578a63f59a4c4e7a065c.exe
2⤵
PID:100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 600
3⤵
- Program crash
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 100 -ip 100
1⤵
PID:1628