b86d6ea3ce0dc5838b25832e447df16bebe6d3da489401bee5b6f565cebea5b7

Analysis

max time kernel
44s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/10/2022, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 289KB
Sample221024-nwp5hsgcb8
SHA256 b86d6ea3ce0dc5838b25832e447df16bebe6d3da489401bee5b6f565cebea5b7
MD5 266fb6a054fec799abc7cf154fd65dc1
SHA1 d29b784e487b89cdf88e1c77ca326e5cd022f8f1
SHA512 39eabbe91cc452951dc09ce6c3acd739c1bfe7366987f4e9e0446f2687e1d49a60c6bc651c92a30cd12203a7361e96d0ec02809c37d011a679a7cd8166a8bc8d
SSDEEP 3072:4bRXvuRWabB6YixgeYy5cAyoqTnI36WBjzKzxKtfIqJIVY2KKEUVsy+vZpMf0Eiw:Hw2pAWQBjzMxWtWVY2pEUVT+vZpAzy+
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1084 set thread context of 848	1084	file.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1916	848	WerFault.exe	28

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 848	1084	file.exe	28
PID 1084 wrote to memory of 848	1084	file.exe	28
PID 1084 wrote to memory of 848	1084	file.exe	28
PID 1084 wrote to memory of 848	1084	file.exe	28
PID 1084 wrote to memory of 848	1084	file.exe	28
PID 1084 wrote to memory of 848	1084	file.exe	28
PID 1084 wrote to memory of 848	1084	file.exe	28
PID 1084 wrote to memory of 848	1084	file.exe	28
PID 1084 wrote to memory of 848	1084	file.exe	28
PID 1084 wrote to memory of 848	1084	file.exe	28
PID 848 wrote to memory of 1916	848	file.exe	29
PID 848 wrote to memory of 1916	848	file.exe	29
PID 848 wrote to memory of 1916	848	file.exe	29
PID 848 wrote to memory of 1916	848	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 96
    3⤵
    - Program crash
    PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-55-0x0000000000070000-0x00000000000A6000-memory.dmp

Download

memory/848-56-0x0000000000070000-0x00000000000A6000-memory.dmp

Download

memory/848-58-0x0000000000070000-0x00000000000A6000-memory.dmp

Download

memory/848-60-0x0000000000070000-0x00000000000A6000-memory.dmp

Download

memory/848-62-0x0000000000070000-0x00000000000A6000-memory.dmp

Download

memory/848-64-0x0000000000070000-0x00000000000A6000-memory.dmp

Download

memory/848-69-0x0000000000070000-0x00000000000A6000-memory.dmp

Download

memory/848-72-0x0000000000070000-0x00000000000A6000-memory.dmp

Download

memory/1084-54-0x00000000010C0000-0x000000000110C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads