e47e898923208e15cedda56de05b9896e2e3df46628a74692d91484ab4fcefcd

Analysis

max time kernel
89s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 10:23

Target

THE NEW ORDER FOR FU#F211213-016(OR22078).exe
Size

472KB
MD5

bc19430f73ce7c06468bb450f99203f2
SHA1

1abfeb24edd346228e56ef94bf5241f2a39b8a4f
SHA256

e47e898923208e15cedda56de05b9896e2e3df46628a74692d91484ab4fcefcd
SHA512

0e75ee453b1bda764817ad97d2f5ec3ff9c8d20a11cded85c5033b34af94f980db251cd163cf7b22a2cca2583545fa41061420f26c280ea303d0e0e44666b7b3
SSDEEP

12288:B4BEjMyXlpQhl+CbZSt0iZV76/L9gaTAri0KvHbxnq:+GjMy+TZgLWZhgi9tn

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1592 580 WerFault.exe THE NEW ORDER FOR FU#F211213-016(OR22078).exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

THE NEW ORDER FOR FU#F211213-016(OR22078).exe

description pid process

Token: SeDebugPrivilege 580 THE NEW ORDER FOR FU#F211213-016(OR22078).exe

pid	pid_target	process	target process
1592	580	WerFault.exe	THE NEW ORDER FOR FU#F211213-016(OR22078).exe

description	pid	process
Token: SeDebugPrivilege	580	THE NEW ORDER FOR FU#F211213-016(OR22078).exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

THE NEW ORDER FOR FU#F211213-016(OR22078).exe

description	pid	process	target process
PID 580 wrote to memory of 1592	580	THE NEW ORDER FOR FU#F211213-016(OR22078).exe	WerFault.exe
PID 580 wrote to memory of 1592	580	THE NEW ORDER FOR FU#F211213-016(OR22078).exe	WerFault.exe
PID 580 wrote to memory of 1592	580	THE NEW ORDER FOR FU#F211213-016(OR22078).exe	WerFault.exe

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 580 -s 532
2⤵
- Program crash
PID:1592

memory/580-54-0x0000000001350000-0x00000000013CA000-memory.dmp

Filesize
488KB

Download
memory/1592-55-0x0000000000000000-mapping.dmp

Download