2f27999bebf5c5bf006a65fcc05db4d7f43d81599d3c7d92ddbf98f91afff048

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19/09/2023, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 393KB
Sample230919-ej3emsgg76
SHA256 2f27999bebf5c5bf006a65fcc05db4d7f43d81599d3c7d92ddbf98f91afff048
MD5 2927f2a7e83c005cfd9171e7cc62ee4a
SHA1 737e30e56666cd9f6f5475bab1edceb9e2654183
SHA512 c060c208ca385892ed83f0409fd9df70cc522fa438bc7146a9ec0df5f485e477f8c2194604240930bcc1e057dae37b7e43083143ccad4f8c4dee92af53372911
SSDEEP 6144:TSyjE12jicP5iOo2T8VrSd/sUAOBklaUAHTVSoiKES9qVNc7GU781Sa:TSyYqiG59oujkAtHTERKzqVNc7nA1Sa
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2960 set thread context of 1156	2960	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	1156	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 2960 wrote to memory of 1156	2960	file.exe	29
PID 1156 wrote to memory of 2652	1156	AppLaunch.exe	30
PID 1156 wrote to memory of 2652	1156	AppLaunch.exe	30
PID 1156 wrote to memory of 2652	1156	AppLaunch.exe	30
PID 1156 wrote to memory of 2652	1156	AppLaunch.exe	30
PID 1156 wrote to memory of 2652	1156	AppLaunch.exe	30
PID 1156 wrote to memory of 2652	1156	AppLaunch.exe	30
PID 1156 wrote to memory of 2652	1156	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 196
    3⤵
    - Program crash
    PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1156-1-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1156-2-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1156-4-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1156-6-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1156-8-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1156-10-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/1156-11-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1156-13-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1156-15-0x0000000000400000-0x000000000042F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads