cb0cc00127f40549832f423400571af4b1ab3500d5336e4da6bae019bcbceab2 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 10:53

Sharing

Report Analysis Logs

General

Target

PURCHASE ORDER.exe
Size

18KB
MD5

f58167d0e2b3692dbac5b35b8907e414
SHA1

5cfaae6b595f0140ea0afa0f4e76ee23474edaae
SHA256

4cba59fde5a74d8e86638c65299b51adacc0ce2af56c1f17cb27c13bf5bb2263
SHA512

e5784c68b0145666b46117deb7276aa20c142306715180501ff9c91a574f7b4f3a2957924111728304a761f317cf63667bbcfa6cb4517cd445ed15736a91766d
SSDEEP

384:X2YZbVxZ4gddXpj3fIQS3l1Hok0NGHISSNZfTQL3:meowdN3sMpGKc7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1224	2044	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1224	2044	PURCHASE ORDER.exe	27
PID 2044 wrote to memory of 1224	2044	PURCHASE ORDER.exe	27
PID 2044 wrote to memory of 1224	2044	PURCHASE ORDER.exe	27

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2044 -s 716
  2⤵
  - Program crash
  PID:1224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-56-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/2044-55-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download