Analysis
-
max time kernel
1191s -
max time network
1235s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 01:33
Static task
static1
Behavioral task
behavioral1
Sample
ORDINE DI ACQUISTO URGENTE.exe
Resource
win7-20221111-en
windows7-x64
2 signatures
1200 seconds
Behavioral task
behavioral2
Sample
ORDINE DI ACQUISTO URGENTE.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
1200 seconds
General
-
Target
ORDINE DI ACQUISTO URGENTE.exe
-
Size
849KB
-
MD5
30fed3bfa7e3fed7fbd5d60f1a444f2d
-
SHA1
b6080144f7cb27b4ad1e79cc65c14388bf87dcc5
-
SHA256
ae5f04e1939d8ce30342a717d15c99489f9afa411aacfdbc85a4f6af79013694
-
SHA512
75a9242870523960d30a747a2b60a7be76d1bb59af5a7ebf005cd614c4a0fd2ee285f74de51817a1f9b8950c4a8fc8b652b4af88c24e004718e910a531e9f5d3
-
SSDEEP
12288:Sod2kWcRLDUVLwDdgT21GeumZJbxpDF81GmGqPBaynlmhGHqsSqyAeugqAPW6ET9:SodeFjBa5hCuNZ/A6CgUP
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 544 1964 WerFault.exe ORDINE DI ACQUISTO URGENTE.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ORDINE DI ACQUISTO URGENTE.exedescription pid process target process PID 1964 wrote to memory of 544 1964 ORDINE DI ACQUISTO URGENTE.exe WerFault.exe PID 1964 wrote to memory of 544 1964 ORDINE DI ACQUISTO URGENTE.exe WerFault.exe PID 1964 wrote to memory of 544 1964 ORDINE DI ACQUISTO URGENTE.exe WerFault.exe PID 1964 wrote to memory of 544 1964 ORDINE DI ACQUISTO URGENTE.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDINE DI ACQUISTO URGENTE.exe"C:\Users\Admin\AppData\Local\Temp\ORDINE DI ACQUISTO URGENTE.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 6802⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-58-0x0000000000000000-mapping.dmp
-
memory/1964-54-0x0000000000DB0000-0x0000000000E8A000-memory.dmpFilesize
872KB
-
memory/1964-55-0x0000000074D81000-0x0000000074D83000-memory.dmpFilesize
8KB
-
memory/1964-56-0x0000000000AE0000-0x0000000000AF8000-memory.dmpFilesize
96KB
-
memory/1964-57-0x0000000000660000-0x000000000066C000-memory.dmpFilesize
48KB