c0d0d8a387188dbaba7b6de3a7fe0ba7b2d03ab23b330fff6c45221d1e77d979

Analysis

max time kernel
130s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:36

Target

c0d0d8a387188dbaba7b6de3a7fe0ba7b2d03ab23b330fff6c45221d1e77d979.exe
Size

107KB
MD5

83b45db55c9911db20709cb93fb280e9
SHA1

00f2bf30087bca65ff327ea2a75df94938901e32
SHA256

c0d0d8a387188dbaba7b6de3a7fe0ba7b2d03ab23b330fff6c45221d1e77d979
SHA512

05a8f53b55ff5a31997b750f937685d99c41ce4dbf1d7c8bf8ec2494069871ee943174be5ba3b00e01e27a05446acb8321f72d8e7060255e5c1077988ef9b958
SSDEEP

3072:REhLjKi6CnK4cT6HKBmg0crZA2fdmpmtrmfp:WjKYcWvcri2fdKZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1372 1836 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
1372	1836	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 4360 wrote to memory of 1836	4360	regsvr32.exe	regsvr32.exe
PID 4360 wrote to memory of 1836	4360	regsvr32.exe	regsvr32.exe
PID 4360 wrote to memory of 1836	4360	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\c0d0d8a387188dbaba7b6de3a7fe0ba7b2d03ab23b330fff6c45221d1e77d979.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4360

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\c0d0d8a387188dbaba7b6de3a7fe0ba7b2d03ab23b330fff6c45221d1e77d979.exe
2⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 600
3⤵
- Program crash
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1836 -ip 1836
1⤵
PID:2872