3e5652bd5e19e49a25d0ce249a0bb7eab04bf6be4f10671648ed06092d78e0f8

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-09-2023 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe
Size

1.4MB
MD5

a58a3507a6d7707183747c1c83c505ae
SHA1

954e649d66a79af88520f6c92d4d41b4c7af5b70
SHA256

c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5
SHA512

6342af3bf3e9e9606c9736237c29306e8e201a35d19117852df836d63ecb713e6bc843aa033b85cee41ecafaa1676defc4c936ef56d0e69d982aae5c4c74160b
SSDEEP

24576:9uSiHnfg5Mz4wC/gmYC+f1HIIS9feDMyQuN10xGIFZdUZWL3FeXsM3vS1lvEBVeY:liHfDoIFCQHIIKWQaBIFZrVeXEv002k

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe

description	pid	process	target process
PID 1928 set thread context of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2584 2676 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
2584	2676	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exeAppLaunch.exe

description	pid	process	target process
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 1928 wrote to memory of 2676	1928	c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe	AppLaunch.exe
PID 2676 wrote to memory of 2584	2676	AppLaunch.exe	WerFault.exe
PID 2676 wrote to memory of 2584	2676	AppLaunch.exe	WerFault.exe
PID 2676 wrote to memory of 2584	2676	AppLaunch.exe	WerFault.exe
PID 2676 wrote to memory of 2584	2676	AppLaunch.exe	WerFault.exe
PID 2676 wrote to memory of 2584	2676	AppLaunch.exe	WerFault.exe
PID 2676 wrote to memory of 2584	2676	AppLaunch.exe	WerFault.exe
PID 2676 wrote to memory of 2584	2676	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe
"C:\Users\Admin\AppData\Local\Temp\c133fb803942c1d67a8406c51836b98f26d22c227439ee2fa6b10893e5b3d7c5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 200
3⤵
- Program crash
PID:2584

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-2-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2676-3-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2676-1-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2676-0-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2676-4-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2676-5-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2676-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2676-7-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2676-9-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2676-11-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download