bd7e8f8ff2db3d253c799414c5c41ef046aecf5790b0b36a2f1eef4763aae16a

Analysis

max time kernel
48s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/04/2023, 03:53

Target
New Order.exe
Size 555KB
Sample230420-efmvsahd41
SHA256 bd7e8f8ff2db3d253c799414c5c41ef046aecf5790b0b36a2f1eef4763aae16a
MD5 eb6c9bf7937687f0bf84f17babc1f316
SHA1 e24b2e66ffa1e9ef984e75c879fb6d572763d075
SHA512 3bb484034f7c3f6a0fb3016b754064b321d23a7b2defea652c9ae015b16ab5513e451c526e4220de8b7f038b1bb7ca4997ab264828a86721e09e04359f1be9f1
SSDEEP 12288:gRj9oj8+4A2GTde2NO7QMCEp30hZcVWYJ0hx+caGLt3:0ZrA2GRet7Prp30hZcVWR5aGLN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	1752	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1488	1752	New Order.exe	28
PID 1752 wrote to memory of 1488	1752	New Order.exe	28
PID 1752 wrote to memory of 1488	1752	New Order.exe	28
PID 1752 wrote to memory of 1488	1752	New Order.exe	28

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 736
  2⤵
  - Program crash
  PID:1488

memory/1752-54-0x00000000013B0000-0x0000000001442000-memory.dmp

Download

memory/1752-55-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Download

memory/1752-56-0x0000000000910000-0x000000000091C000-memory.dmp

Download

memory/1752-57-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Download

memory/1752-58-0x0000000000A10000-0x0000000000A1C000-memory.dmp

Download

memory/1752-59-0x0000000004C80000-0x0000000004CEA000-memory.dmp

Download