bdefdcbdd5af76934913cdfc76ac1785f6df8a5fe32d36e1fbabcf8de754867a

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 393KB
Sample230919-dp6tksee4y
SHA256 bdefdcbdd5af76934913cdfc76ac1785f6df8a5fe32d36e1fbabcf8de754867a
MD5 be36bdd314d0625a1187a2405f8a359f
SHA1 922c44b9735ae340c17c946680a2020124a5dc40
SHA512 b55dbabdad4786d87ab17aa8a86a2ab71b1a15fe5d44665f2903550d0296722e56b2694dd57fc0f09b3012e42c7bc8a3e89b92f35fc283a31282f8e907c439f6
SSDEEP 6144:U2QjEf2jicP5iOo2T8VrSd/sUAOqklYQ4Fai/TsLVnpeNVBjqx9sA5n1Sa:U2QKqiG59ouYkZAaibA1x1Sa
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1396 set thread context of 2132	1396	file.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2776	2132	WerFault.exe	30

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 1396 wrote to memory of 2132	1396	file.exe	30
PID 2132 wrote to memory of 2776	2132	AppLaunch.exe	31
PID 2132 wrote to memory of 2776	2132	AppLaunch.exe	31
PID 2132 wrote to memory of 2776	2132	AppLaunch.exe	31
PID 2132 wrote to memory of 2776	2132	AppLaunch.exe	31
PID 2132 wrote to memory of 2776	2132	AppLaunch.exe	31
PID 2132 wrote to memory of 2776	2132	AppLaunch.exe	31
PID 2132 wrote to memory of 2776	2132	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 196
    3⤵
    - Program crash
    PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-1-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2132-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2132-3-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2132-2-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2132-5-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2132-4-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2132-7-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2132-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2132-9-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2132-11-0x0000000000400000-0x000000000042F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads