2d6e0405a2a3b73566f01d21c9747d6a09e65a0b093f980d915d3cb3f1ff89b3

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 05:55

Target

SOA OEC Freight Korea.exe
Size

613KB
MD5

f878c9cbe2b0447a108032df274e7f74
SHA1

a25d519a8093591bd3a953b7bc0d39864723c893
SHA256

2d6e0405a2a3b73566f01d21c9747d6a09e65a0b093f980d915d3cb3f1ff89b3
SHA512

cf8d4e3968dab7d18401f098f88fabbaee338b52ab118f305d585a6b0892716632770d5f2bc94226baf5706266e23c6c593c08bada12491439cc0b5eb5363b09
SSDEEP

12288:zmAY2kcdbL4Ef70MESJNvl4UDrCnxFKp4GCp2NFkHh/pf/qKko4MmVNso:yN6GEf70MEqhiyyxtmKmoFmVNso

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2896	2468	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2896	2468	SOA OEC Freight Korea.exe	30
PID 2468 wrote to memory of 2896	2468	SOA OEC Freight Korea.exe	30
PID 2468 wrote to memory of 2896	2468	SOA OEC Freight Korea.exe	30
PID 2468 wrote to memory of 2896	2468	SOA OEC Freight Korea.exe	30

C:\Users\Admin\AppData\Local\Temp\SOA OEC Freight Korea.exe
"C:\Users\Admin\AppData\Local\Temp\SOA OEC Freight Korea.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 660
  2⤵
  - Program crash
  PID:2896

memory/2468-54-0x0000000000CE0000-0x0000000000D7E000-memory.dmp

Filesize
632KB

Download
memory/2468-55-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2468-56-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2468-57-0x0000000000740000-0x000000000074E000-memory.dmp

Filesize
56KB

Download
memory/2468-58-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2468-59-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2468-60-0x0000000000A60000-0x0000000000A6A000-memory.dmp

Filesize
40KB

Download