ae5f04e1939d8ce30342a717d15c99489f9afa411aacfdbc85a4f6af79013694

Resubmissions

07-12-2022 01:33

28-11-2022 15:23

max time kernel
53s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 15:23

Target

ORDINE DI ACQUISTO URGENTE.exe
Size

849KB
MD5

30fed3bfa7e3fed7fbd5d60f1a444f2d
SHA1

b6080144f7cb27b4ad1e79cc65c14388bf87dcc5
SHA256

ae5f04e1939d8ce30342a717d15c99489f9afa411aacfdbc85a4f6af79013694
SHA512

75a9242870523960d30a747a2b60a7be76d1bb59af5a7ebf005cd614c4a0fd2ee285f74de51817a1f9b8950c4a8fc8b652b4af88c24e004718e910a531e9f5d3
SSDEEP

12288:Sod2kWcRLDUVLwDdgT21GeumZJbxpDF81GmGqPBaynlmhGHqsSqyAeugqAPW6ET9:SodeFjBa5hCuNZ/A6CgUP

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1000 1908 WerFault.exe ORDINE DI ACQUISTO URGENTE.exe

pid	pid_target	process	target process
1000	1908	WerFault.exe	ORDINE DI ACQUISTO URGENTE.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ORDINE DI ACQUISTO URGENTE.exe

description	pid	process	target process
PID 1908 wrote to memory of 1000	1908	ORDINE DI ACQUISTO URGENTE.exe	WerFault.exe
PID 1908 wrote to memory of 1000	1908	ORDINE DI ACQUISTO URGENTE.exe	WerFault.exe
PID 1908 wrote to memory of 1000	1908	ORDINE DI ACQUISTO URGENTE.exe	WerFault.exe
PID 1908 wrote to memory of 1000	1908	ORDINE DI ACQUISTO URGENTE.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ORDINE DI ACQUISTO URGENTE.exe
"C:\Users\Admin\AppData\Local\Temp\ORDINE DI ACQUISTO URGENTE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 688
  2⤵
  - Program crash
  PID:1000

memory/1000-58-0x0000000000000000-mapping.dmp

Download
memory/1908-54-0x0000000000B10000-0x0000000000BEA000-memory.dmp

Filesize
872KB

Download
memory/1908-55-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1908-56-0x0000000000AF0000-0x0000000000B08000-memory.dmp

Filesize
96KB

Download
memory/1908-57-0x0000000002060000-0x000000000206C000-memory.dmp

Filesize
48KB

Download