27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18/09/2023, 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe
Size

1.4MB
MD5

d1d2d184ae07a4077b02e0560f4ade3a
SHA1

1fccc8fd08ab87e1d02c4794f4696d52e3db3b76
SHA256

27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a
SHA512

c12eb6d233b6f47427fa27248d70fa4cbdbe224bc1a0e5d029d3c0d241f250d223c2bcb5bbfef62eef2fd92760e73e96cd798e51b6972e95367aa5a366f87f1d
SSDEEP

24576:G39tcBGDKccauLKj2LuJ1kD1wVs0AMkJDRTJ8SExf1qLvkk9bfB8f7vhVGw:G398XBG2C81wVqfJDjJof1Wkk9fB8f77

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2776	2932	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2860 wrote to memory of 2932	2860	JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe	28
PID 2932 wrote to memory of 2776	2932	AppLaunch.exe	29
PID 2932 wrote to memory of 2776	2932	AppLaunch.exe	29
PID 2932 wrote to memory of 2776	2932	AppLaunch.exe	29
PID 2932 wrote to memory of 2776	2932	AppLaunch.exe	29
PID 2932 wrote to memory of 2776	2932	AppLaunch.exe	29
PID 2932 wrote to memory of 2776	2932	AppLaunch.exe	29
PID 2932 wrote to memory of 2776	2932	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe
"C:\Users\Admin\AppData\Local\Temp\JC_27f65b0231c49bd90c9f704ba747ffeaf5f11ae20996559502af54d6e75b895a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 200
    3⤵
    - Program crash
    PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-0-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2932-1-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2932-2-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2932-3-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2932-4-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2932-5-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2932-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-7-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2932-9-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download
memory/2932-11-0x0000000000400000-0x000000000053B000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads