0bddc6655ba739d631907c6b5063348789dd75356258f5aa846907342e77bec4

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
20/11/2023, 09:23

Target

purchase_order.exe
Size

315KB
MD5

072c3199ba451fcfc9eea4d87f000ad2
SHA1

fe7990138d2c5df16eb407fd9cb828b7dad6430a
SHA256

0bddc6655ba739d631907c6b5063348789dd75356258f5aa846907342e77bec4
SHA512

3c34bf2cfe70ee20d110c245dc5271ce46b35d1167e5b52a59dfa56ae38a5552d4f0bb5ba60a494a9bf9a0ecd8dc9c2e71d582d7cc30d674a44c24bc6c363bc1
SSDEEP

6144:1oyZPhx6QTSm9+Vzq6PH1c2f6jTy3gNDzqiDe45XuvPpb8FuPdQSiiKsZtCqi/A8:NT9aH1c2f6jTy3gNDzqiDe45XuvPpbpe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2744	1180	WerFault.exe	15

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2744	1180	purchase_order.exe	28
PID 1180 wrote to memory of 2744	1180	purchase_order.exe	28
PID 1180 wrote to memory of 2744	1180	purchase_order.exe	28
PID 1180 wrote to memory of 2744	1180	purchase_order.exe	28

C:\Users\Admin\AppData\Local\Temp\purchase_order.exe
"C:\Users\Admin\AppData\Local\Temp\purchase_order.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 564
  2⤵
  - Program crash
  PID:2744

memory/1180-1-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1180-0-0x00000000009B0000-0x0000000000A06000-memory.dmp

Filesize
344KB

Download
memory/1180-2-0x0000000000530000-0x0000000000570000-memory.dmp

Filesize
256KB

Download
memory/1180-3-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download
memory/1180-4-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1180-5-0x0000000000530000-0x0000000000570000-memory.dmp

Filesize
256KB

Download