Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2023, 19:36

General

  • Target

    a3215f787711a390adcfcd3e9ab769b0.exe

  • Size

    1.4MB

  • MD5

    a3215f787711a390adcfcd3e9ab769b0

  • SHA1

    e6e7cb768c612ded84780d2c4f2a15f2405fb41d

  • SHA256

    e1d9c7c171cedf715b269a4a4a70667a60743e9b32389a65ebcf22b08f06b068

  • SHA512

    3741fc72cf8a43f3baf563a2a82207dfa425de2b8f8d034d8996b2953633ecd9f18275e80dd9afb2a713d87e54debf9ca1b541650256ecbd17cd5bc7cc0e4118

  • SSDEEP

    24576:5H3SO/gaG3cSMXpATPU62jxERqyRGFsUg+KZ+STEyYTCumgzqVamzG5VRYf:FSc8sbuTU6kxvyRGS+KZ+STEdmuxzRmv

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3215f787711a390adcfcd3e9ab769b0.exe
    "C:\Users\Admin\AppData\Local\Temp\a3215f787711a390adcfcd3e9ab769b0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:488
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:2172
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 200
          3⤵
          • Program crash
          PID:2336
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 100
        2⤵
        • Program crash
        PID:1728

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1152-0-0x0000000000400000-0x000000000053D000-memory.dmp

            Filesize

            1.2MB

          • memory/1152-1-0x0000000000400000-0x000000000053D000-memory.dmp

            Filesize

            1.2MB

          • memory/1152-2-0x0000000000400000-0x000000000053D000-memory.dmp

            Filesize

            1.2MB

          • memory/1152-4-0x0000000000400000-0x000000000053D000-memory.dmp

            Filesize

            1.2MB

          • memory/1152-3-0x0000000000400000-0x000000000053D000-memory.dmp

            Filesize

            1.2MB

          • memory/1152-5-0x0000000000400000-0x000000000053D000-memory.dmp

            Filesize

            1.2MB

          • memory/1152-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

            Filesize

            4KB

          • memory/1152-7-0x0000000000400000-0x000000000053D000-memory.dmp

            Filesize

            1.2MB

          • memory/1152-9-0x0000000000400000-0x000000000053D000-memory.dmp

            Filesize

            1.2MB

          • memory/1152-11-0x0000000000400000-0x000000000053D000-memory.dmp

            Filesize

            1.2MB