3508674e78e25a2ee057e9e667c73515367d45388a9cfda3358b1ee668cb1798 | Triage

Analysis

max time kernel
30s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23/12/2022, 11:12

Sharing

Report Analysis Logs

General

Target

file.exe
Size

145KB
MD5

a92b642fe1a1d8f98152f0d95affc079
SHA1

cd45d2f073c6fc3c232605f8c1bc02759a2a2ed0
SHA256

3508674e78e25a2ee057e9e667c73515367d45388a9cfda3358b1ee668cb1798
SHA512

98c8cde91d8e9066bacd613889bcab348834d6984d556a6764f16575d54de259ee215a0d297f2bca3c5fa8d3ddcbb3cce233da51bf9ceb74fae76289f7f97bcd
SSDEEP

3072:Ff4lB9JN6cNv5r8B/AgDkIZObemgrAPPISVaMficxnn69qcTtQpO6hB:KXZr8BIUkYOb7AAZVy4n6YgQ5

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1260 set thread context of 2040	1260	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
564	1260	WerFault.exe	27

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2040	1260	file.exe	29
PID 1260 wrote to memory of 2040	1260	file.exe	29
PID 1260 wrote to memory of 2040	1260	file.exe	29
PID 1260 wrote to memory of 2040	1260	file.exe	29
PID 1260 wrote to memory of 2040	1260	file.exe	29
PID 1260 wrote to memory of 2040	1260	file.exe	29
PID 1260 wrote to memory of 2040	1260	file.exe	29
PID 1260 wrote to memory of 2040	1260	file.exe	29
PID 1260 wrote to memory of 2040	1260	file.exe	29
PID 1260 wrote to memory of 564	1260	file.exe	30
PID 1260 wrote to memory of 564	1260	file.exe	30
PID 1260 wrote to memory of 564	1260	file.exe	30
PID 1260 wrote to memory of 564	1260	file.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 52
  2⤵
  - Program crash
  PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2040-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download