ca45c2dbf273409b568ea3761db578e5a38f160114c040582fc0c13fdfae3fa3

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-09-2023 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe
Size

1.4MB
MD5

b4013992181b3adc5a30306bcee4a3c0
SHA1

20050cf3d49b3a005afb3d1612c5cedb6247dad3
SHA256

e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195
SHA512

dfdad8f155b65c84ac22cb5e2b45726a57327a6e8d68b49a50495f3b973773bf50238357e56cf944f63bc5f7dd147da37f7dc8ce60ceabe3370cfe0aa2b29c45
SSDEEP

24576:oXSiH2vNZFofU/QD4CprDoBrwh0Nho+wqR4PEfaW1tYhFR+0volAnLqTmh+s52:FibU/ErDoBshIg6p1tUF/vdGMR

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe

description	pid	process	target process
PID 2124 set thread context of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2724 2784 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
2724	2784	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exeAppLaunch.exe

description	pid	process	target process
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2124 wrote to memory of 2784	2124	e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe	AppLaunch.exe
PID 2784 wrote to memory of 2724	2784	AppLaunch.exe	WerFault.exe
PID 2784 wrote to memory of 2724	2784	AppLaunch.exe	WerFault.exe
PID 2784 wrote to memory of 2724	2784	AppLaunch.exe	WerFault.exe
PID 2784 wrote to memory of 2724	2784	AppLaunch.exe	WerFault.exe
PID 2784 wrote to memory of 2724	2784	AppLaunch.exe	WerFault.exe
PID 2784 wrote to memory of 2724	2784	AppLaunch.exe	WerFault.exe
PID 2784 wrote to memory of 2724	2784	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe
"C:\Users\Admin\AppData\Local\Temp\e40823d7f765baf063442d1953ed4a134d481d74486ac39ec746bb868e3c8195.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 200
3⤵
- Program crash
PID:2724

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-2-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/2784-1-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/2784-0-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/2784-3-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/2784-5-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/2784-4-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/2784-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2784-8-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/2784-10-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/2784-12-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download