9d71ee189111bc08ce384a02a16be8594ccd91c8ef5c0d1dde1ce2ef97ffdb5c

Analysis

max time kernel
45s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/05/2023, 19:38

Target

ORDERS4500215527.exe
Size

689KB
MD5

65ab45a78dc696699f075f57269fc55e
SHA1

d154122b1b3bf9e5f4a651dd419ef32146641452
SHA256

9d71ee189111bc08ce384a02a16be8594ccd91c8ef5c0d1dde1ce2ef97ffdb5c
SHA512

b06842e7807dd249c5cd3abcfb47cb8a37d6892932f5e232a6156f6d4d59a7940adf530267c6241287b313a9c0f3eca169e55bf6a215b91ef5a292359ac083d9
SSDEEP

12288:ZNZUq1LbcAhYKq0bs61BUdfsnhviCrP62CaKyu:iBR30jPdKCrPcaK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
564	1520	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 564	1520	ORDERS4500215527.exe	28
PID 1520 wrote to memory of 564	1520	ORDERS4500215527.exe	28
PID 1520 wrote to memory of 564	1520	ORDERS4500215527.exe	28

C:\Users\Admin\AppData\Local\Temp\ORDERS4500215527.exe
"C:\Users\Admin\AppData\Local\Temp\ORDERS4500215527.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1520 -s 676
  2⤵
  - Program crash
  PID:564

memory/1520-54-0x00000000009A0000-0x0000000000A52000-memory.dmp

Filesize
712KB

Download
memory/1520-55-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/1520-56-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/1520-57-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/1520-58-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/1520-59-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/1520-61-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/1520-62-0x000000001B280000-0x000000001B2E6000-memory.dmp

Filesize
408KB

Download