6f2b77f58f937a596f42f65bb7bde2b9d310c9a6b15316ef6c0573ffa2e25bbe

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
25/09/2023, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe
Size 380KB
Sample230925-c21mnada57
SHA256 6f2b77f58f937a596f42f65bb7bde2b9d310c9a6b15316ef6c0573ffa2e25bbe
MD5 f4a032b70f073051e3a57905025490ba
SHA1 f397bb82382c468cf1a3507b1a2613313bcd0274
SHA512 bc207565e86f4953e0c34a33bc8e5714716b24caea0f08c15897716f71459450f2e9d4ee070c3d7988feabe041d6f484037b1b9091543f3fa735fa9175f49110
SSDEEP 6144:8lPjhHX110KwTVSf3pOCq5b6uAOQR14fq8HhbhtXUHAbjERPwJNX7SpsM/fUqwm:8lPN3110dVaUcuKfSq8Hhbx/SFwm
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3060	2040	WerFault.exe	25
1968	2248	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 2248	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	28
PID 2040 wrote to memory of 3060	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	29
PID 2040 wrote to memory of 3060	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	29
PID 2040 wrote to memory of 3060	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	29
PID 2040 wrote to memory of 3060	2040	SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe	29
PID 2248 wrote to memory of 1968	2248	AppLaunch.exe	30
PID 2248 wrote to memory of 1968	2248	AppLaunch.exe	30
PID 2248 wrote to memory of 1968	2248	AppLaunch.exe	30
PID 2248 wrote to memory of 1968	2248	AppLaunch.exe	30
PID 2248 wrote to memory of 1968	2248	AppLaunch.exe	30
PID 2248 wrote to memory of 1968	2248	AppLaunch.exe	30
PID 2248 wrote to memory of 1968	2248	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.16298.25169.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 196
    3⤵
    - Program crash
    PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 52
  2⤵
  - Program crash
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2248-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2248-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2248-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2248-5-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2248-6-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2248-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2248-8-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2248-10-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2248-12-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads