5039a39740937dd3fd1b72d0bcdf61a2816c1866bdd040393acb8778eb7fab52

Analysis

max time kernel
51s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:14

Target
ORDEN DE COMPRA OI 15969 - OI 15975.exe
Size 1.0MB
Sample240613-bl2dksyeja
SHA256 7d7d34382b3cceb6642cd716cf9c0755d63309491c0e8206da2fea04f0ed4dee
MD5 58702e61bc3312403f93f3cde87efe5e
SHA1 744571e4a9147ca107b35dafd7c22955d987e39d
SHA512 b8d81afbd774d98e03f44408edf30cbc534bfcee3582070d169aaecb575fbda39886ca2919b1a29d03668b60173489043665d8f122dba8554a9318ba6d71829e
SSDEEP 24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHak40deGtq+UGQeK5:gh+ZkldoPK8Yak40deGtbUV7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1812	4000	WerFault.exe	80

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4000	ORDEN DE COMPRA OI 15969 - OI 15975.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4000	ORDEN DE COMPRA OI 15969 - OI 15975.exe
4000	ORDEN DE COMPRA OI 15969 - OI 15975.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4000	ORDEN DE COMPRA OI 15969 - OI 15975.exe
4000	ORDEN DE COMPRA OI 15969 - OI 15975.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 768	4000	ORDEN DE COMPRA OI 15969 - OI 15975.exe	84
PID 4000 wrote to memory of 768	4000	ORDEN DE COMPRA OI 15969 - OI 15975.exe	84
PID 4000 wrote to memory of 768	4000	ORDEN DE COMPRA OI 15969 - OI 15975.exe	84
PID 4000 wrote to memory of 768	4000	ORDEN DE COMPRA OI 15969 - OI 15975.exe	84

C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA OI 15969 - OI 15975.exe
"C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA OI 15969 - OI 15975.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA OI 15969 - OI 15975.exe"
  2⤵
  PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 700
  2⤵
  - Program crash
  PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4000 -ip 4000
1⤵
PID:1624

memory/4000-10-0x0000000004520000-0x0000000004524000-memory.dmp

Download