bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe
Size

229KB
MD5

75abed533d92ca6b675c4103a8bd91c2
SHA1

64b05a5b8f175958e607f5841e1a72eea31e34b7
SHA256

bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248
SHA512

3a99200beabd00188b07dff64fed109c885ccb150d1ea8ebb1e1f756d8838cab7f16f9a4f649b6e6c0f1f5ea129a8c159705c4dcbe967af9b1952a1410230779
SSDEEP

3072:Te512ddlKNBGognqsxtOYQWOFGbfD0bBHGKkPKMJpPGEfN3wbEi5net6Oox5:TegqGhq+5fD0bkvjpPF13QECnE25

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1552	1784	WerFault.exe	28

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28
PID 2028 wrote to memory of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28
PID 2028 wrote to memory of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28
PID 2028 wrote to memory of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28
PID 2028 wrote to memory of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28
PID 2028 wrote to memory of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28
PID 2028 wrote to memory of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28
PID 2028 wrote to memory of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28
PID 2028 wrote to memory of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28
PID 2028 wrote to memory of 1784	2028	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	28
PID 1784 wrote to memory of 1552	1784	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	29
PID 1784 wrote to memory of 1552	1784	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	29
PID 1784 wrote to memory of 1552	1784	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	29
PID 1784 wrote to memory of 1552	1784	bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe	29

C:\Users\Admin\AppData\Local\Temp\bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe
"C:\Users\Admin\AppData\Local\Temp\bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe
  C:\Users\Admin\AppData\Local\Temp\bbe1892345327ab483a4cdaf8f477317fbb4a77a9a792ce13a8b1e1bfa7f4248.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 88
    3⤵
    - Program crash
    PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1784-56-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1784-57-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1784-59-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1784-61-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1784-63-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1784-66-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1784-70-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2028-69-0x0000000000400000-0x0000000000409001-memory.dmp

Filesize
36KB

Download
memory/2028-71-0x0000000000380000-0x000000000038A000-memory.dmp

Filesize
40KB

Download
memory/2028-72-0x0000000000400000-0x0000000000409001-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads