a9a3fbcaf842de2dbc60fc6e42d13572625bc8ca8464c73425fd54625e52991f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
29/09/2023, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.PWSX-gen.17897.exe
Size

356KB
MD5

959f6f1ba1caa0728e4f70eea43c3f18
SHA1

26ae9ae5e0455a9661f22bf209077b6b76763b6f
SHA256

a9a3fbcaf842de2dbc60fc6e42d13572625bc8ca8464c73425fd54625e52991f
SHA512

ae72c5037883cb3a1085bf6350f80b95643674ca9119d871049a6fb5d1560f7cb906affedb1169a9c92a08199a87c2dcf1212870c2d3af40c3c103f4fbdf5a49
SSDEEP

6144:0g3W8/s5GqrO5aXnfEGIXWMvZAOu0PioZ/A9NFo3h2kDGxes0BC+:A8cGqrOk8Jx6oZ/ANo3h2kDees0BC+

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2648	3028	WerFault.exe	27
2764	3048	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 3048	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	29
PID 3028 wrote to memory of 2648	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	30
PID 3028 wrote to memory of 2648	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	30
PID 3028 wrote to memory of 2648	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	30
PID 3028 wrote to memory of 2648	3028	SecuriteInfo.com.Win32.PWSX-gen.17897.exe	30
PID 3048 wrote to memory of 2764	3048	AppLaunch.exe	31
PID 3048 wrote to memory of 2764	3048	AppLaunch.exe	31
PID 3048 wrote to memory of 2764	3048	AppLaunch.exe	31
PID 3048 wrote to memory of 2764	3048	AppLaunch.exe	31
PID 3048 wrote to memory of 2764	3048	AppLaunch.exe	31
PID 3048 wrote to memory of 2764	3048	AppLaunch.exe	31
PID 3048 wrote to memory of 2764	3048	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.17897.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.17897.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 196
    3⤵
    - Program crash
    PID:2764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 76
  2⤵
  - Program crash
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3048-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3048-10-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3048-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3048-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3048-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3048-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3048-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3048-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3048-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads