c062d589d7d1620d80b5b5d5bc42616181da55be9cdafed8f05d222369bf03a8

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/09/2023, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe
Size 264KB
Sample230907-1ercgaed23
SHA256 c062d589d7d1620d80b5b5d5bc42616181da55be9cdafed8f05d222369bf03a8
MD5 10f478d0d0ced59cb3d5558abb9df7d0
SHA1 8dd139efe1ed5164eb8f68a7f1e46d390c06c58b
SHA512 7a610866f644ff7ef1a1774bfec6a9483dc1b5fdaa30acc566baecdb6ea7ab1764f7c7bc1b7ff1b67cb472bde426a8925d34a966723c24a5269d2e7fea462075
SSDEEP 6144:xb6PWJ9nd1kCh2EonANdOaEpGvKPQr/mlOKfOQ+8ZUZ:xGCHkC7dLJCPQTml3OaUZ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2764	2984	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 1612 wrote to memory of 2984	1612	SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe	29
PID 2984 wrote to memory of 2764	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2764	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2764	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2764	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2764	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2764	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2764	2984	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.60850.1236.2666.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 196
    3⤵
    - Program crash
    PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2984-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2984-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2984-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2984-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2984-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2984-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2984-5-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2984-7-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2984-9-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2984-11-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads