d65457967ab5ef2ac43c210821d99a3ccdfe8fdc07c7eedb79c577ac06aaac84

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

700KB
MD5

39fb1158796a5cf0d4364d51fa68bc30
SHA1

7b6d9bdd81803fe9149bf62b3d19c244d8315c3a
SHA256

d65457967ab5ef2ac43c210821d99a3ccdfe8fdc07c7eedb79c577ac06aaac84
SHA512

2f5b8ca42ea8011a6f109bd689ab05e8eafcec1a969eb3e1adc7fff879ee4d6d6f52c0c7528dc1e0bae5f49102248c6a40c1a07a27977a610fdc4dadd1fa743b
SSDEEP

6144:z6vGALXgBEIy8wluzNcq/PVucQpyaIYdXF4AloNTZnJwxEQ4cID5Yxuyfbvfr:OHXgFysVucQpQYJabTVJlDHGxu4r

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 1060	2396	file.exe	30

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1888	2396	WerFault.exe	12
2748	1060	WerFault.exe	30

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2840	2396	file.exe	29
PID 2396 wrote to memory of 2840	2396	file.exe	29
PID 2396 wrote to memory of 2840	2396	file.exe	29
PID 2396 wrote to memory of 2840	2396	file.exe	29
PID 2396 wrote to memory of 2840	2396	file.exe	29
PID 2396 wrote to memory of 2840	2396	file.exe	29
PID 2396 wrote to memory of 2840	2396	file.exe	29
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1060	2396	file.exe	30
PID 2396 wrote to memory of 1888	2396	file.exe	31
PID 2396 wrote to memory of 1888	2396	file.exe	31
PID 2396 wrote to memory of 1888	2396	file.exe	31
PID 2396 wrote to memory of 1888	2396	file.exe	31
PID 1060 wrote to memory of 2748	1060	AppLaunch.exe	32
PID 1060 wrote to memory of 2748	1060	AppLaunch.exe	32
PID 1060 wrote to memory of 2748	1060	AppLaunch.exe	32
PID 1060 wrote to memory of 2748	1060	AppLaunch.exe	32
PID 1060 wrote to memory of 2748	1060	AppLaunch.exe	32
PID 1060 wrote to memory of 2748	1060	AppLaunch.exe	32
PID 1060 wrote to memory of 2748	1060	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 196
    3⤵
    - Program crash
    PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 100
  2⤵
  - Program crash
  PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1060-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1060-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1060-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1060-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1060-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1060-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1060-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1060-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1060-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads