ec70df5d6e789759aba200e31c25b8bc9657f973d0fad4c79ef5efb880efa5b0 | Triage™

Analysis

max time kernel
40s
max time network
42s
platform
windows7_x64
resource
win7-20220414-en
submitted
06/06/2022, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order.exe
Size 1.4MB
Sample220606-x272ysfdaq
SHA256 ec70df5d6e789759aba200e31c25b8bc9657f973d0fad4c79ef5efb880efa5b0
MD5 f750a6df1e0df375f06fb52c7baebf79
SHA1 ff1453fe92df05336803140e940d6198b837b8e9
SHA512 eddccdc5fcd0b6497d307a14047e99361cd9a6f8eb161b366c6ce2bc3a0058c25535fb589b0f6ccb650029f1dc43fbd0ede7d082891b31fc7669d0635693ec00
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	872	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 952	872	Purchase Order.exe	27
PID 872 wrote to memory of 952	872	Purchase Order.exe	27
PID 872 wrote to memory of 952	872	Purchase Order.exe	27
PID 872 wrote to memory of 952	872	Purchase Order.exe	27

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 580
  2⤵
  - Program crash
  PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-54-0x0000000000820000-0x000000000098A000-memory.dmp

Download

memory/872-55-0x0000000000430000-0x000000000049A000-memory.dmp

Download