9aed7d8a3e5ace7928781369f253c3f138ab4c1e95ac276962387340c0544000

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:59

Target

9aed7d8a3e5ace7928781369f253c3f138ab4c1e95ac276962387340c0544000.exe
Size

107KB
MD5

26705aa61b0bd2f546bc13416646eb66
SHA1

6fc4229d09a37ab548e8d0a75cae5ff6fcc789c6
SHA256

9aed7d8a3e5ace7928781369f253c3f138ab4c1e95ac276962387340c0544000
SHA512

1b6930edb2adcbec88033b93561a3cb34010866a1b833d4a74bae4aec2c7df4e4b86235606446b9c482550431da7c55933ee5d8a40db4229e53b3a8ac72babd2
SSDEEP

3072:REhLjKf6CnK4cT6HKBmg0crZA2fdmpmtcmfp:WjK9cWvcri2fdKu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4372 3260 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
4372	3260	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 3508 wrote to memory of 3260	3508	regsvr32.exe	regsvr32.exe
PID 3508 wrote to memory of 3260	3508	regsvr32.exe	regsvr32.exe
PID 3508 wrote to memory of 3260	3508	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9aed7d8a3e5ace7928781369f253c3f138ab4c1e95ac276962387340c0544000.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\9aed7d8a3e5ace7928781369f253c3f138ab4c1e95ac276962387340c0544000.exe
2⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 600
3⤵
- Program crash
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3260 -ip 3260
1⤵
PID:3848