ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239

Analysis

max time kernel
127s
max time network
132s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
19/09/2023, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe
Size

395KB
MD5

fd758b03f2dbf49add88ae73f02ee17b
SHA1

288e22667ab6d2b2837b4580c5b62c93f6442313
SHA256

ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239
SHA512

2bd45fedfa32144a85c2d4245cf917cbe2bfce7341afc256a3a8601a5677cbc484c8d6c92425a40ab8fb80f7cb914d1c56599ce29fc2430ab25cbc723f5e3ff0
SSDEEP

6144:u+5TmInU3SPmZbHh3Y/feAOTuuepv3/gbbQ2sIsNzeRaDJ/XDFCjn2GZj4lAfYyl:u+jU3SPJ/2zepabQ1LCnDZjyEYyUi

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4168 set thread context of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4012	4168	WerFault.exe	69

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4544	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	71
PID 4168 wrote to memory of 4544	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	71
PID 4168 wrote to memory of 4544	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	71
PID 4168 wrote to memory of 4864	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	72
PID 4168 wrote to memory of 4864	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	72
PID 4168 wrote to memory of 4864	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	72
PID 4168 wrote to memory of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73
PID 4168 wrote to memory of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73
PID 4168 wrote to memory of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73
PID 4168 wrote to memory of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73
PID 4168 wrote to memory of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73
PID 4168 wrote to memory of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73
PID 4168 wrote to memory of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73
PID 4168 wrote to memory of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73
PID 4168 wrote to memory of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73
PID 4168 wrote to memory of 4088	4168	ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe	73

C:\Users\Admin\AppData\Local\Temp\ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe
"C:\Users\Admin\AppData\Local\Temp\ac72a79b73a04d663add8ed95214f448d06dd7fe4bb23da0f356ca1dcd76e239.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 284
  2⤵
  - Program crash
  PID:4012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4088-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4088-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4088-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4088-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4088-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads