10df8c533f48189e56d16dd5d04d838f592cfe8d6c1690fe29454ec308c6e12b

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 07:00

Target

Order Specification-887762.exe
Size

742KB
MD5

03c2f941af8cede493cd177fbe9cea96
SHA1

f811f24a5bb048e5aaec2e7456bb6597c2408359
SHA256

10df8c533f48189e56d16dd5d04d838f592cfe8d6c1690fe29454ec308c6e12b
SHA512

2a71ef2dd5bfdad6a167a9b1c735e256cd6775614fe672e3e18a858fad87542b6c136383d5aff0d95739a496fb94d9b0ccf70cfa4903d8b5e81550628fe53b0c
SSDEEP

12288:1Ov5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi+FqA/vJ1saEauZDa+:1q5TfcdHj4fmbv9VEzNr

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/368-55-0x0000000000070000-0x0000000000214000-memory.dmp	upx
behavioral1/memory/368-57-0x0000000000070000-0x0000000000214000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/368-57-0x0000000000070000-0x0000000000214000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Order Specification-887762.exe

description pid process target process

PID 368 set thread context of 1100 368 Order Specification-887762.exe Order Specification-887762.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1592 368 WerFault.exe Order Specification-887762.exe

description	pid	process	target process
PID 368 set thread context of 1100	368	Order Specification-887762.exe	Order Specification-887762.exe

pid	pid_target	process	target process
1592	368	WerFault.exe	Order Specification-887762.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Order Specification-887762.exe

description	pid	process	target process
PID 368 wrote to memory of 1100	368	Order Specification-887762.exe	Order Specification-887762.exe
PID 368 wrote to memory of 1100	368	Order Specification-887762.exe	Order Specification-887762.exe
PID 368 wrote to memory of 1100	368	Order Specification-887762.exe	Order Specification-887762.exe
PID 368 wrote to memory of 1100	368	Order Specification-887762.exe	Order Specification-887762.exe
PID 368 wrote to memory of 1100	368	Order Specification-887762.exe	Order Specification-887762.exe
PID 368 wrote to memory of 1592	368	Order Specification-887762.exe	WerFault.exe
PID 368 wrote to memory of 1592	368	Order Specification-887762.exe	WerFault.exe
PID 368 wrote to memory of 1592	368	Order Specification-887762.exe	WerFault.exe
PID 368 wrote to memory of 1592	368	Order Specification-887762.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Order Specification-887762.exe
"C:\Users\Admin\AppData\Local\Temp\Order Specification-887762.exe"
2⤵
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 296
2⤵
- Program crash
PID:1592

memory/368-54-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/368-55-0x0000000000070000-0x0000000000214000-memory.dmp

Filesize
1.6MB

Download
memory/368-57-0x0000000000070000-0x0000000000214000-memory.dmp

Filesize
1.6MB

Download
memory/368-58-0x0000000002C90000-0x0000000002E34000-memory.dmp

Filesize
1.6MB

Download
memory/1592-56-0x0000000000000000-mapping.dmp

Download