Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
23/09/2023, 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3215f787711a390adcfcd3e9ab769b0.exe
Resource
win7-20230831-en
3 signatures
150 seconds
General
-
Target
a3215f787711a390adcfcd3e9ab769b0.exe
-
Size
1.4MB
-
MD5
a3215f787711a390adcfcd3e9ab769b0
-
SHA1
e6e7cb768c612ded84780d2c4f2a15f2405fb41d
-
SHA256
e1d9c7c171cedf715b269a4a4a70667a60743e9b32389a65ebcf22b08f06b068
-
SHA512
3741fc72cf8a43f3baf563a2a82207dfa425de2b8f8d034d8996b2953633ecd9f18275e80dd9afb2a713d87e54debf9ca1b541650256ecbd17cd5bc7cc0e4118
-
SSDEEP
24576:5H3SO/gaG3cSMXpATPU62jxERqyRGFsUg+KZ+STEyYTCumgzqVamzG5VRYf:FSc8sbuTU6kxvyRGS+KZ+STEdmuxzRmv
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 488 set thread context of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 -
Program crash 2 IoCs
pid pid_target Process procid_target 1728 488 WerFault.exe 27 2336 1152 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 488 wrote to memory of 2172 488 a3215f787711a390adcfcd3e9ab769b0.exe 29 PID 488 wrote to memory of 2172 488 a3215f787711a390adcfcd3e9ab769b0.exe 29 PID 488 wrote to memory of 2172 488 a3215f787711a390adcfcd3e9ab769b0.exe 29 PID 488 wrote to memory of 2172 488 a3215f787711a390adcfcd3e9ab769b0.exe 29 PID 488 wrote to memory of 2172 488 a3215f787711a390adcfcd3e9ab769b0.exe 29 PID 488 wrote to memory of 2172 488 a3215f787711a390adcfcd3e9ab769b0.exe 29 PID 488 wrote to memory of 2172 488 a3215f787711a390adcfcd3e9ab769b0.exe 29 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1152 488 a3215f787711a390adcfcd3e9ab769b0.exe 30 PID 488 wrote to memory of 1728 488 a3215f787711a390adcfcd3e9ab769b0.exe 31 PID 488 wrote to memory of 1728 488 a3215f787711a390adcfcd3e9ab769b0.exe 31 PID 488 wrote to memory of 1728 488 a3215f787711a390adcfcd3e9ab769b0.exe 31 PID 488 wrote to memory of 1728 488 a3215f787711a390adcfcd3e9ab769b0.exe 31 PID 1152 wrote to memory of 2336 1152 AppLaunch.exe 32 PID 1152 wrote to memory of 2336 1152 AppLaunch.exe 32 PID 1152 wrote to memory of 2336 1152 AppLaunch.exe 32 PID 1152 wrote to memory of 2336 1152 AppLaunch.exe 32 PID 1152 wrote to memory of 2336 1152 AppLaunch.exe 32 PID 1152 wrote to memory of 2336 1152 AppLaunch.exe 32 PID 1152 wrote to memory of 2336 1152 AppLaunch.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3215f787711a390adcfcd3e9ab769b0.exe"C:\Users\Admin\AppData\Local\Temp\a3215f787711a390adcfcd3e9ab769b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2172
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 2003⤵
- Program crash
PID:2336
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 1002⤵
- Program crash
PID:1728
-