91d09956afe46c743cbb7f4e328d97e409057a66eae85e6e6a8706468d0371c5

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:26

Target

91d09956afe46c743cbb7f4e328d97e409057a66eae85e6e6a8706468d0371c5.exe
Size

107KB
MD5

dbc60062f4f4fef79a8de97fe3d3b630
SHA1

91e71445a99b67913dabb4225a20bf19790790b3
SHA256

91d09956afe46c743cbb7f4e328d97e409057a66eae85e6e6a8706468d0371c5
SHA512

91a8d5c23a7a2036f52da35c2cb9d1676e8293b7b6b769c6c03cfd06182bca940b560b1cfc6b41c5bc4351e6feeac381727a92d8514c8d7ad57c1c4bc3a5ab4b
SSDEEP

3072:REhLjKD6CnK4cT6HKBmg0crZA2fdmpmtJmfp:WjKJcWvcri2fdKP

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1860 2180 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
1860	2180	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1900 wrote to memory of 2180	1900	regsvr32.exe	regsvr32.exe
PID 1900 wrote to memory of 2180	1900	regsvr32.exe	regsvr32.exe
PID 1900 wrote to memory of 2180	1900	regsvr32.exe	regsvr32.exe
PID 1900 wrote to memory of 2180	1900	regsvr32.exe	regsvr32.exe
PID 1900 wrote to memory of 2180	1900	regsvr32.exe	regsvr32.exe
PID 1900 wrote to memory of 2180	1900	regsvr32.exe	regsvr32.exe
PID 1900 wrote to memory of 2180	1900	regsvr32.exe	regsvr32.exe
PID 2180 wrote to memory of 1860	2180	regsvr32.exe	WerFault.exe
PID 2180 wrote to memory of 1860	2180	regsvr32.exe	WerFault.exe
PID 2180 wrote to memory of 1860	2180	regsvr32.exe	WerFault.exe
PID 2180 wrote to memory of 1860	2180	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\91d09956afe46c743cbb7f4e328d97e409057a66eae85e6e6a8706468d0371c5.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\91d09956afe46c743cbb7f4e328d97e409057a66eae85e6e6a8706468d0371c5.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 292
3⤵
- Program crash
PID:1860