da470d4433a7d4f504309ca7ce7f613943d5a686af7ea9ec4460f8a875c926c2

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 01:28

Target

da470d4433a7d4f504309ca7ce7f613943d5a686af7ea9ec4460f8a875c926c2.exe
Size

464KB
MD5

6d78733e6d45aab6e3e180fc009ae9b4
SHA1

88ecc77464bdff8583ea095fe2ce09dc8edc6f0d
SHA256

da470d4433a7d4f504309ca7ce7f613943d5a686af7ea9ec4460f8a875c926c2
SHA512

f00846e08c88a005b39bd2121e81b5464e19b11c7d5f209e77f9c2f25976d18eecc23167017e0a7575178c0cca39c4dd4727685cd8b450b18249cef1933e6eed
SSDEEP

3072:yhRykxCdEYXNfq6I7GUuyswOpfvZ3BdOYOTq6MUqzCWj5vfLuDM2GnB4P8mT7UAF:2R24XpOx51OWDzCW5vfqQ2Gq8mT7ULxK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	624	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2896	624	da470d4433a7d4f504309ca7ce7f613943d5a686af7ea9ec4460f8a875c926c2.exe	28
PID 624 wrote to memory of 2896	624	da470d4433a7d4f504309ca7ce7f613943d5a686af7ea9ec4460f8a875c926c2.exe	28
PID 624 wrote to memory of 2896	624	da470d4433a7d4f504309ca7ce7f613943d5a686af7ea9ec4460f8a875c926c2.exe	28
PID 624 wrote to memory of 2896	624	da470d4433a7d4f504309ca7ce7f613943d5a686af7ea9ec4460f8a875c926c2.exe	28

C:\Users\Admin\AppData\Local\Temp\da470d4433a7d4f504309ca7ce7f613943d5a686af7ea9ec4460f8a875c926c2.exe
"C:\Users\Admin\AppData\Local\Temp\da470d4433a7d4f504309ca7ce7f613943d5a686af7ea9ec4460f8a875c926c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 152
  2⤵
  - Program crash
  PID:2896