9aed7d8a3e5ace7928781369f253c3f138ab4c1e95ac276962387340c0544000

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:59

Target

9aed7d8a3e5ace7928781369f253c3f138ab4c1e95ac276962387340c0544000.exe
Size

107KB
MD5

26705aa61b0bd2f546bc13416646eb66
SHA1

6fc4229d09a37ab548e8d0a75cae5ff6fcc789c6
SHA256

9aed7d8a3e5ace7928781369f253c3f138ab4c1e95ac276962387340c0544000
SHA512

1b6930edb2adcbec88033b93561a3cb34010866a1b833d4a74bae4aec2c7df4e4b86235606446b9c482550431da7c55933ee5d8a40db4229e53b3a8ac72babd2
SSDEEP

3072:REhLjKf6CnK4cT6HKBmg0crZA2fdmpmtcmfp:WjK9cWvcri2fdKu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2732 1792 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
2732	1792	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1924 wrote to memory of 1792	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1792	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1792	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1792	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1792	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1792	1924	regsvr32.exe	regsvr32.exe
PID 1924 wrote to memory of 1792	1924	regsvr32.exe	regsvr32.exe
PID 1792 wrote to memory of 2732	1792	regsvr32.exe	WerFault.exe
PID 1792 wrote to memory of 2732	1792	regsvr32.exe	WerFault.exe
PID 1792 wrote to memory of 2732	1792	regsvr32.exe	WerFault.exe
PID 1792 wrote to memory of 2732	1792	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9aed7d8a3e5ace7928781369f253c3f138ab4c1e95ac276962387340c0544000.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\9aed7d8a3e5ace7928781369f253c3f138ab4c1e95ac276962387340c0544000.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 292
3⤵
- Program crash
PID:2732