b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18/09/2023, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe
Size

1.4MB
MD5

39b81b7c1839653a56956482a7d213fb
SHA1

43ebc12bbc3678eef74f63cba986f4dff5f8869a
SHA256

b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d
SHA512

dc0d0eb774dae0ee9b9df5d3a1032d05741a3e6bd408a86b0e693d12255a1f0d244cc220c421558d33ee976f363faaf3df9ca18de9e18dc00b86330f8186ee73
SSDEEP

24576:R39cTROLu8V0qtQlknnugKLFe52434qYAw3HZ3b2ZsmC5+BHt1VR4aw:R39cTROLu8i5+JKcMMYAw3Z3sPC5+BNe

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2920 set thread context of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	2044	WerFault.exe	30

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2920 wrote to memory of 2044	2920	JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe	30
PID 2044 wrote to memory of 2284	2044	AppLaunch.exe	31
PID 2044 wrote to memory of 2284	2044	AppLaunch.exe	31
PID 2044 wrote to memory of 2284	2044	AppLaunch.exe	31
PID 2044 wrote to memory of 2284	2044	AppLaunch.exe	31
PID 2044 wrote to memory of 2284	2044	AppLaunch.exe	31
PID 2044 wrote to memory of 2284	2044	AppLaunch.exe	31
PID 2044 wrote to memory of 2284	2044	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe
"C:\Users\Admin\AppData\Local\Temp\JC_b149eeddae1cbc16455533794fbbfaef7cd11052cf03388fa96754f1b8141c7d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 200
    3⤵
    - Program crash
    PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-0-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2044-1-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2044-2-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2044-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2044-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2044-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2044-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2044-7-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2044-9-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2044-11-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads