cf830389d2ddb53e02e2d83dd36f7a5837c8dc7e6b2612e02243db990434e392

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-09-2023 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe
Size

1.4MB
MD5

9a8214fda779a464350f63ce18631284
SHA1

6bddf0b25f8e2d53f1e169b3f525231222d07ce7
SHA256

9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d
SHA512

029e7780a3c0895225baa8508b6c152c3bfc64c47aa1855532555a3430b7b6fab2ebdcddf2f37a5c44d33aab4b81f4da5338dbde5d9bc1988a9992c1f562b409
SSDEEP

24576:HWGkfGnbs3rOyb9KAN7he34EbMVci7r2wpX/KnVfIAKYumeIRJatm:hkubs3qO9dgoOMKBVfIjo2tm

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe

description	pid	process	target process
PID 1856 set thread context of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2636 1984 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
2636	1984	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exeAppLaunch.exe

description	pid	process	target process
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1856 wrote to memory of 1984	1856	9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe	AppLaunch.exe
PID 1984 wrote to memory of 2636	1984	AppLaunch.exe	WerFault.exe
PID 1984 wrote to memory of 2636	1984	AppLaunch.exe	WerFault.exe
PID 1984 wrote to memory of 2636	1984	AppLaunch.exe	WerFault.exe
PID 1984 wrote to memory of 2636	1984	AppLaunch.exe	WerFault.exe
PID 1984 wrote to memory of 2636	1984	AppLaunch.exe	WerFault.exe
PID 1984 wrote to memory of 2636	1984	AppLaunch.exe	WerFault.exe
PID 1984 wrote to memory of 2636	1984	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe
"C:\Users\Admin\AppData\Local\Temp\9bfc61d0341b99912d183d8b3a212275313289085498b2ea167722998cd43e3d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 200
3⤵
- Program crash
PID:2636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-0-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1984-1-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1984-3-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1984-2-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1984-5-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1984-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1984-7-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1984-4-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1984-9-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/1984-11-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download