da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 11:16

Target

da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d.exe
Size

1.1MB
MD5

f6324b899292c2e889e616e91847fa58
SHA1

b30b35f9c3151d1d42a9787b20867b1a277714ac
SHA256

da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d
SHA512

a5878caf92c5f9e3db0fda366f31f44bcca163e30163404a5198424a12703cf442608d7ba7c659ac5c90e2da5117197a3797f42ec53544e9af8259cf2db69222
SSDEEP

24576:wkrftCV7nLDX0HoCaqTkK80TcUfbYB22kmpb24f54MvMl:wuwL72TQ0TBYB22kmpb24f54l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3716	1172	WerFault.exe	88

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1172	da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d.exe
1172	da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1172	2536	da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d.exe	88
PID 2536 wrote to memory of 1172	2536	da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d.exe	88
PID 2536 wrote to memory of 1172	2536	da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d.exe	88

C:\Users\Admin\AppData\Local\Temp\da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d.exe
"C:\Users\Admin\AppData\Local\Temp\da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d.exe
  "C:\Users\Admin\AppData\Local\Temp\da380a3ce036f4ef699d5cf004eb7ff134c40a4a1848e76d3e8d79ffe95d063d.exe" --cp
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 1752
    3⤵
    - Program crash
    PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1172 -ip 1172
1⤵
PID:3084