d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe
Size

371KB
MD5

06f9a373fd5690bb78ebe92e8fc8bd27
SHA1

8a67ac86e3e9291d64b67128c94675b8b2dae9d9
SHA256

d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea
SHA512

8c480b768b89ba4f55146361ab9df092b780d46fb4a35acf8e73288b413c2b06961610b94b0c601fa418314fb6511786b7358986db63d65d919d6a28abb042d2
SSDEEP

6144:AEvJm09zORs+z/TMify9DAOYgQ2YD99li/um5+tR4odlB684WC8/:AMw09CK5NLSD99loum5mY8/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2152	2764	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2228 wrote to memory of 2764	2228	d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe	28
PID 2764 wrote to memory of 2152	2764	AppLaunch.exe	29
PID 2764 wrote to memory of 2152	2764	AppLaunch.exe	29
PID 2764 wrote to memory of 2152	2764	AppLaunch.exe	29
PID 2764 wrote to memory of 2152	2764	AppLaunch.exe	29
PID 2764 wrote to memory of 2152	2764	AppLaunch.exe	29
PID 2764 wrote to memory of 2152	2764	AppLaunch.exe	29
PID 2764 wrote to memory of 2152	2764	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe
"C:\Users\Admin\AppData\Local\Temp\d518562e66665d210993ae66d43dfed7d70ff463bc831c0033963955e89026ea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 196
    3⤵
    - Program crash
    PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2764-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2764-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2764-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2764-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2764-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2764-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2764-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2764-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2764-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads