dbbbdd2732a4209e2e1250ad814f92482d551eda1cef8bbc5a57afc394de29a5

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 09:21

Target

New Order.exe
Size

1.1MB
MD5

6bc15e368b93a47ff7b62023301343f0
SHA1

1ccb7749f1febc520155aab75f17c222b00baf3e
SHA256

dbbbdd2732a4209e2e1250ad814f92482d551eda1cef8bbc5a57afc394de29a5
SHA512

fe5c208a3d7831ba55373c985131db79f88c0467706117653360380e249321e89dd9fa04f780a8f7e042666148704dc42f6b7361ce333384c208e9c78529c5d5
SSDEEP

24576:NtD/EeChpBNp0iz9BKkaIVRYer/t0Y9+4qedVOEOAgRg5IEN2P:P+Rp0iaka/epn847dVOEOAg25Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2788	2560	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2788	2560	New Order.exe	28
PID 2560 wrote to memory of 2788	2560	New Order.exe	28
PID 2560 wrote to memory of 2788	2560	New Order.exe	28
PID 2560 wrote to memory of 2788	2560	New Order.exe	28

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 728
  2⤵
  - Program crash
  PID:2788

memory/2560-0-0x0000000000D20000-0x0000000000E36000-memory.dmp

Filesize
1.1MB

Download
memory/2560-1-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2560-2-0x0000000004FD0000-0x0000000005010000-memory.dmp

Filesize
256KB

Download
memory/2560-3-0x00000000007A0000-0x00000000007B8000-memory.dmp

Filesize
96KB

Download
memory/2560-4-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2560-5-0x0000000000500000-0x000000000050A000-memory.dmp

Filesize
40KB

Download
memory/2560-6-0x0000000005D70000-0x0000000005E4C000-memory.dmp

Filesize
880KB

Download
memory/2560-7-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2560-8-0x0000000004FD0000-0x0000000005010000-memory.dmp

Filesize
256KB

Download