31a3b9ab7afdf2ab38c3cee03bbd45b8ffde4f595ba9c20e97d784e1261881d6

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 20:05

Target

31a3b9ab7afdf2ab38c3cee03bbd45b8ffde4f595ba9c20e97d784e1261881d6.exe
Size

107KB
MD5

413831dc05fd11b8fb4de336e4b478e7
SHA1

5039e2420fec9c5e985deb3f4d510a501c7fb1a7
SHA256

31a3b9ab7afdf2ab38c3cee03bbd45b8ffde4f595ba9c20e97d784e1261881d6
SHA512

166a1ca003affed01de72225981da7266d9d6bd59e85c54706918b2fefbede35144a63edb04fd16c8f183162a28ceb91e5746d48872b05d0468142f44a358d36
SSDEEP

3072:REhLjKo6CnK4cT6HKBmg0crZA2fdmpmt8mfp:WjKKcWvcri2fdKS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2224	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2224	2856	regsvr32.exe	28
PID 2856 wrote to memory of 2224	2856	regsvr32.exe	28
PID 2856 wrote to memory of 2224	2856	regsvr32.exe	28
PID 2856 wrote to memory of 2224	2856	regsvr32.exe	28
PID 2856 wrote to memory of 2224	2856	regsvr32.exe	28
PID 2856 wrote to memory of 2224	2856	regsvr32.exe	28
PID 2856 wrote to memory of 2224	2856	regsvr32.exe	28
PID 2224 wrote to memory of 2872	2224	regsvr32.exe	29
PID 2224 wrote to memory of 2872	2224	regsvr32.exe	29
PID 2224 wrote to memory of 2872	2224	regsvr32.exe	29
PID 2224 wrote to memory of 2872	2224	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\31a3b9ab7afdf2ab38c3cee03bbd45b8ffde4f595ba9c20e97d784e1261881d6.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\31a3b9ab7afdf2ab38c3cee03bbd45b8ffde4f595ba9c20e97d784e1261881d6.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 292
    3⤵
    - Program crash
    PID:2872