093633adb83458e238c55c8eca405986d8f646e533e2d31d7bbc8182f143dcef

General

Target

4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe
Size

1.4MB
MD5

d48ed9782c4530e04a4d6ab826448acd
SHA1

96cc378d575bbaecbe3b6a0e4800bdbc04b31c38
SHA256

4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c
SHA512

f9af992dc8ad2187aa5225188f02edeb9cd4e678b5c29a3848d188975b8ba97a9b09550b4baae80f17eb8f3358cf14fc3a1dcd5c7c77caf8dd1c93868d1f83fe
SSDEEP

24576:AWnkfGnbsl/gqWu64y9uksNujHLsfW6bh6s5QBuJsVBGb5c:3kubsZOuksNdXF4Ssg5c

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe

description	pid	process	target process
PID 2200 set thread context of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2588 2076 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
2588	2076	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exeAppLaunch.exe

description	pid	process	target process
PID 2200 wrote to memory of 2032	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2032	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2032	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2032	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2032	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2032	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2032	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2200 wrote to memory of 2076	2200	4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe	AppLaunch.exe
PID 2076 wrote to memory of 2588	2076	AppLaunch.exe	WerFault.exe
PID 2076 wrote to memory of 2588	2076	AppLaunch.exe	WerFault.exe
PID 2076 wrote to memory of 2588	2076	AppLaunch.exe	WerFault.exe
PID 2076 wrote to memory of 2588	2076	AppLaunch.exe	WerFault.exe
PID 2076 wrote to memory of 2588	2076	AppLaunch.exe	WerFault.exe
PID 2076 wrote to memory of 2588	2076	AppLaunch.exe	WerFault.exe
PID 2076 wrote to memory of 2588	2076	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe
"C:\Users\Admin\AppData\Local\Temp\4ce1a06a482a8456062fc344861b993a2d825f5b2038d92c5da1ff1b63ebf72c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 200
3⤵
- Program crash
PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2076-1-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2076-2-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2076-3-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2076-4-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2076-5-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2076-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2076-7-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2076-9-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2076-11-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing