1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14-11-2023 17:31

231114-v3qg7acf42 10

14-11-2023 17:21

28-10-2023 19:29

24-10-2023 13:29

18-10-2023 12:04

07-09-2023 12:10

Analysis

max time kernel
21s
max time network
18s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
Size

173KB
MD5

bfdf311cad652de3e51a581ec3a19338
SHA1

df3cc8cdc962de4f0624a927fcda16f84eb804db
SHA256

8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe
SHA512

6860d7b32831949fba14bbdce1d9bc4d674031dcbf012db9be26192946200b63522f6eb3f33987539d5145b94ed697bfe768c9836eaaff6ef77d5d178fd2f0b8
SSDEEP

3072:bUhIPIFXANhUUnE7uuvptpyE6cDoqifjffcxy:aI5UUE7uuxDoqcEy

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2368 set thread context of 2112	2368	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
724	2112	WerFault.exe	28

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2112	2368	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	28
PID 2368 wrote to memory of 2112	2368	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	28
PID 2368 wrote to memory of 2112	2368	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	28
PID 2368 wrote to memory of 2112	2368	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	28
PID 2368 wrote to memory of 2112	2368	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	28
PID 2368 wrote to memory of 2112	2368	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	28
PID 2368 wrote to memory of 2112	2368	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	28
PID 2368 wrote to memory of 2112	2368	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	28
PID 2368 wrote to memory of 2112	2368	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	28
PID 2112 wrote to memory of 724	2112	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	29
PID 2112 wrote to memory of 724	2112	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	29
PID 2112 wrote to memory of 724	2112	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	29
PID 2112 wrote to memory of 724	2112	8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe	29

C:\Users\Admin\AppData\Local\Temp\8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
"C:\Users\Admin\AppData\Local\Temp\8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe
  "C:\Users\Admin\AppData\Local\Temp\8d8576432cd79c4c6a8902e9fcbdad16c871afae3731a4d9ec9cb6a0be727ffe.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 120
    3⤵
    - Program crash
    PID:724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2112-3-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2112-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2112-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2112-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2112-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2368-1-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download