1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02

General

Target

1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe
Size

119KB
MD5

84b2337f37f3ffca9f499488338acbdf
SHA1

aec31b1ee5064fda88ba71bc039d01d0ed8f41a0
SHA256

1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02
SHA512

3edaea9532a9590ada7052fa5e45e45b66c5c54faa4ffd4ca3a1db6e474b37fe4c6d20be4cb4ae0c682baf036da0620869be6a3fa2eda273a1a601e5cf7076c2
SSDEEP

3072:0etJmZ1tPha7oSF/X1Hyy7nYjCxi/Rsff:0QQZbh4oANXYnWf

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
852	652	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe
1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28
PID 1700 wrote to memory of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28
PID 1700 wrote to memory of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28
PID 1700 wrote to memory of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28
PID 1700 wrote to memory of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28
PID 1700 wrote to memory of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28
PID 1700 wrote to memory of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28
PID 1700 wrote to memory of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28
PID 1700 wrote to memory of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28
PID 1700 wrote to memory of 1000	1700	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	28
PID 1000 wrote to memory of 652	1000	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	29
PID 1000 wrote to memory of 652	1000	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	29
PID 1000 wrote to memory of 652	1000	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	29
PID 1000 wrote to memory of 652	1000	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	29
PID 1000 wrote to memory of 652	1000	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	29
PID 1000 wrote to memory of 652	1000	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	29
PID 1000 wrote to memory of 652	1000	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	29
PID 1000 wrote to memory of 652	1000	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	29
PID 1000 wrote to memory of 652	1000	1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe	29
PID 652 wrote to memory of 852	652	explorer.exe	30
PID 652 wrote to memory of 852	652	explorer.exe	30
PID 652 wrote to memory of 852	652	explorer.exe	30
PID 652 wrote to memory of 852	652	explorer.exe	30

C:\Users\Admin\AppData\Local\Temp\1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe
"C:\Users\Admin\AppData\Local\Temp\1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe
  "C:\Users\Admin\AppData\Local\Temp\1ff239cc5f2c259f863778e4fd8f449418de02eb4f94b0f00072ee2bc8618a02.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 232
      4⤵
      Program crash
      PID:852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/652-67-0x0000000000120000-0x0000000000123000-memory.dmp

Filesize
12KB

Download
memory/652-71-0x0000000074CB1000-0x0000000074CB3000-memory.dmp

Filesize
8KB

Download
memory/652-65-0x0000000000110000-0x0000000000114000-memory.dmp

Filesize
16KB

Download
memory/1000-58-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1000-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1700-54-0x0000000076771000-0x0000000076773000-memory.dmp

Filesize
8KB

Download
memory/1700-73-0x0000000000240000-0x0000000000245000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads