91d09956afe46c743cbb7f4e328d97e409057a66eae85e6e6a8706468d0371c5

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:26

Target

91d09956afe46c743cbb7f4e328d97e409057a66eae85e6e6a8706468d0371c5.exe
Size

107KB
MD5

dbc60062f4f4fef79a8de97fe3d3b630
SHA1

91e71445a99b67913dabb4225a20bf19790790b3
SHA256

91d09956afe46c743cbb7f4e328d97e409057a66eae85e6e6a8706468d0371c5
SHA512

91a8d5c23a7a2036f52da35c2cb9d1676e8293b7b6b769c6c03cfd06182bca940b560b1cfc6b41c5bc4351e6feeac381727a92d8514c8d7ad57c1c4bc3a5ab4b
SSDEEP

3072:REhLjKD6CnK4cT6HKBmg0crZA2fdmpmtJmfp:WjKJcWvcri2fdKP

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4896 1120 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
4896	1120	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2288 wrote to memory of 1120	2288	regsvr32.exe	regsvr32.exe
PID 2288 wrote to memory of 1120	2288	regsvr32.exe	regsvr32.exe
PID 2288 wrote to memory of 1120	2288	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\91d09956afe46c743cbb7f4e328d97e409057a66eae85e6e6a8706468d0371c5.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\91d09956afe46c743cbb7f4e328d97e409057a66eae85e6e6a8706468d0371c5.exe
2⤵
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 600
3⤵
- Program crash
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1120 -ip 1120
1⤵
PID:2304