da509c534d97c3e2e517c01191b863be427c7347dca0313c0232028f46247846

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 21:05

Target

da509c534d97c3e2e517c01191b863be427c7347dca0313c0232028f46247846.exe
Size

508KB
MD5

7998a5ede2cbb2b74abd1ec1bc56d78e
SHA1

527786f9f3be5b2fb19594e461de1bbd17e9f134
SHA256

da509c534d97c3e2e517c01191b863be427c7347dca0313c0232028f46247846
SHA512

70d37772166c5988e165d2b58c0872815d1902a2e9b1f2bc89529242c7c9f0237cd1bd55db72acdd105fca754004b68072105b5a223e67592e33c46dd706a5b8
SSDEEP

6144:LLXqEg+EhIX2kQTcWj2XwvRFWM9rppV065gSbjwpyTsdbUanKY+i/kxDLBYdG:LU+EhIXPQQWVzWMljuS4Se1KY+zLBY0

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\LogFiles\Dwm\{msdt-9er-45fr-gthb89}_4595.log	da509c534d97c3e2e517c01191b863be427c7347dca0313c0232028f46247846.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	1880	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1928	1880	da509c534d97c3e2e517c01191b863be427c7347dca0313c0232028f46247846.exe	28
PID 1880 wrote to memory of 1928	1880	da509c534d97c3e2e517c01191b863be427c7347dca0313c0232028f46247846.exe	28
PID 1880 wrote to memory of 1928	1880	da509c534d97c3e2e517c01191b863be427c7347dca0313c0232028f46247846.exe	28
PID 1880 wrote to memory of 1928	1880	da509c534d97c3e2e517c01191b863be427c7347dca0313c0232028f46247846.exe	28

C:\Users\Admin\AppData\Local\Temp\da509c534d97c3e2e517c01191b863be427c7347dca0313c0232028f46247846.exe
"C:\Users\Admin\AppData\Local\Temp\da509c534d97c3e2e517c01191b863be427c7347dca0313c0232028f46247846.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 136
  2⤵
  - Program crash
  PID:1928