62c4a1fafc66fd389428f73ef74c2e7309ebd3be53eeb934a8a447fa51ee253b

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 04:07

Target

NEW ORDER--GO23B005840.exe
Size

802KB
MD5

44c4b20bb49166936e7aa375852c9e9c
SHA1

e804be6592df45c34c675a6b3ebece24d5a9cc16
SHA256

62c4a1fafc66fd389428f73ef74c2e7309ebd3be53eeb934a8a447fa51ee253b
SHA512

b06f336c9b9c09b30e84778227ad0ef667c611202766db4ca7c51e1c90780608534666699a1f712e8eae7096cfa3f0f28228739e2e9db42c56d2b6ba694f1274
SSDEEP

12288:RwLJR9C9IaL10Md+GIQ5IcziVYsHFC9QGzlWZC2b7WrEFl:RwLjxaGMd3INczeHM95MZC22rw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	3028	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2888	3028	NEW ORDER--GO23B005840.exe	30
PID 3028 wrote to memory of 2888	3028	NEW ORDER--GO23B005840.exe	30
PID 3028 wrote to memory of 2888	3028	NEW ORDER--GO23B005840.exe	30
PID 3028 wrote to memory of 2888	3028	NEW ORDER--GO23B005840.exe	30

C:\Users\Admin\AppData\Local\Temp\NEW ORDER--GO23B005840.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER--GO23B005840.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 664
  2⤵
  - Program crash
  PID:2888

memory/3028-0-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-1-0x00000000010C0000-0x0000000001190000-memory.dmp

Filesize
832KB

Download
memory/3028-2-0x0000000074320000-0x0000000074A0E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-3-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/3028-4-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download
memory/3028-5-0x0000000004C00000-0x0000000004C40000-memory.dmp

Filesize
256KB

Download
memory/3028-6-0x0000000000540000-0x000000000054A000-memory.dmp

Filesize
40KB

Download