da02b4423a1ec650e41d880efc628da99fc9b6f5f473cd280a4f9f9bd7022dd6

Analysis

max time kernel
41s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:59

Target

da02b4423a1ec650e41d880efc628da99fc9b6f5f473cd280a4f9f9bd7022dd6.exe
Size

429KB
MD5

abe668b8bb14cc7563f5707595049d45
SHA1

cf4e7210a6d88b57a7cd512e3cf9ce1a68c75624
SHA256

da02b4423a1ec650e41d880efc628da99fc9b6f5f473cd280a4f9f9bd7022dd6
SHA512

ffbe76eec0c1bf7858b1f800f7e9eff313992e73963784dc44d2668ec38a8d33b9b5e611790bd0b174bad8b85cca15593a2c10cb00edf653fb168a8aa69f236b
SSDEEP

6144:BptGvL59Lh6JSq/2JHOCKVBzakE7G/XAxb5vSr31RYDrLhCSTBhdgfGau:wvLHYKJHOJVBz+1xbh831RYDr1thZx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	1216	WerFault.exe	21

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 884	1216	da02b4423a1ec650e41d880efc628da99fc9b6f5f473cd280a4f9f9bd7022dd6.exe	28
PID 1216 wrote to memory of 884	1216	da02b4423a1ec650e41d880efc628da99fc9b6f5f473cd280a4f9f9bd7022dd6.exe	28
PID 1216 wrote to memory of 884	1216	da02b4423a1ec650e41d880efc628da99fc9b6f5f473cd280a4f9f9bd7022dd6.exe	28
PID 1216 wrote to memory of 884	1216	da02b4423a1ec650e41d880efc628da99fc9b6f5f473cd280a4f9f9bd7022dd6.exe	28

C:\Users\Admin\AppData\Local\Temp\da02b4423a1ec650e41d880efc628da99fc9b6f5f473cd280a4f9f9bd7022dd6.exe
"C:\Users\Admin\AppData\Local\Temp\da02b4423a1ec650e41d880efc628da99fc9b6f5f473cd280a4f9f9bd7022dd6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 196
  2⤵
  - Program crash
  PID:884

memory/1216-54-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download
memory/1216-55-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1216-57-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download