6bf19b47e17a3856e31e384b6aa304346e151f2c41385d01da5834a751fae776

Analysis

max time kernel
237s
max time network
313s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2023, 09:18

Target
New Order.exe
Size 13KB
Sample230209-k9mprsdf91
SHA256 6bf19b47e17a3856e31e384b6aa304346e151f2c41385d01da5834a751fae776
MD5 7d75fc0dec90f41e388c904d92750905
SHA1 ca4e7bb6af3d9328dfb66d9f4fcd6c46ef4e2677
SHA512 70df11fafdf6261729c3f8c40d9e3ae6e2e7b5b8b3da608973e4e025436d8e042d47d82bbb6f5c896eefde99b732f8cc4787ec32f67d243d21319e6f744aab46
SSDEEP 384:kYVYVMIM/F1tIbE31qCTzZK4v6wzbaZv:rYVtM/NIQqCTzB6SbSv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3064	3544	WerFault.exe	77
1120	3544	WerFault.exe	77

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3064	3544	New Order.exe	80
PID 3544 wrote to memory of 3064	3544	New Order.exe	80

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3544 -s 1164
  2⤵
  - Program crash
  PID:3064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3544 -s 1164
  2⤵
  - Program crash
  PID:1120

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 188 -p 3544 -ip 3544
1⤵
PID:3248

memory/3544-132-0x0000024978A30000-0x0000024978A38000-memory.dmp

Download

memory/3544-133-0x00007FFCF9AC0000-0x00007FFCFA581000-memory.dmp

Download

memory/3544-134-0x00007FFCF9AC0000-0x00007FFCFA581000-memory.dmp

Download