169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d

General

Target

169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe
Size

186KB
MD5

e16d01d0118e21114dfa768ea202b000
SHA1

67f655d7b56de913b5ce2935d2c95596087267bc
SHA256

169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d
SHA512

70425b4842abcca59a524c5908185f00643fe56fd3bbd8f98de8e0214b68e861dafe99bc5cf993e5d05fd3ac1236202a53962244ec6e204a330e996fb6ffb178
SSDEEP

1536:AlynghFPBs1hE+pnkyjeK56NNUcLDFr+ycjAcMP:TpG+pnkyjpUNC2FrIAcq

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1944 set thread context of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	2024	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe
1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26
PID 1944 wrote to memory of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26
PID 1944 wrote to memory of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26
PID 1944 wrote to memory of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26
PID 1944 wrote to memory of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26
PID 1944 wrote to memory of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26
PID 1944 wrote to memory of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26
PID 1944 wrote to memory of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26
PID 1944 wrote to memory of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26
PID 1944 wrote to memory of 1972	1944	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	26
PID 1972 wrote to memory of 2024	1972	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	27
PID 1972 wrote to memory of 2024	1972	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	27
PID 1972 wrote to memory of 2024	1972	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	27
PID 1972 wrote to memory of 2024	1972	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	27
PID 1972 wrote to memory of 2024	1972	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	27
PID 1972 wrote to memory of 2024	1972	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	27
PID 1972 wrote to memory of 2024	1972	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	27
PID 1972 wrote to memory of 2024	1972	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	27
PID 1972 wrote to memory of 2024	1972	169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe	27
PID 2024 wrote to memory of 1324	2024	explorer.exe	28
PID 2024 wrote to memory of 1324	2024	explorer.exe	28
PID 2024 wrote to memory of 1324	2024	explorer.exe	28
PID 2024 wrote to memory of 1324	2024	explorer.exe	28

C:\Users\Admin\AppData\Local\Temp\169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe
"C:\Users\Admin\AppData\Local\Temp\169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe
  "C:\Users\Admin\AppData\Local\Temp\169b62e860d591d687248fb2b45861ed19d0720da4513a898ac95c313b696d1d.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 232
      4⤵
      Program crash
      PID:1324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1944-63-0x00000000003B0000-0x00000000003B5000-memory.dmp

Filesize
20KB

Download
memory/1972-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1972-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1972-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1972-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1972-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1972-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1972-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2024-66-0x0000000000090000-0x0000000000094000-memory.dmp

Filesize
16KB

Download
memory/2024-68-0x00000000000A0000-0x00000000000A3000-memory.dmp

Filesize
12KB

Download
memory/2024-72-0x0000000074FC1000-0x0000000074FC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads