a00de9822a95f9d479024444d4b8ccb2588a4a88311936d9045f57e5e235c247

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

356KB
MD5

119aa67c40d0956aa05f231fe37e1953
SHA1

060aa98d14fcc3b712c40a9467f0311b9ab2886b
SHA256

a00de9822a95f9d479024444d4b8ccb2588a4a88311936d9045f57e5e235c247
SHA512

bf899230cd3cca65869397a93273dd2ca6e8d18626f056e54836c3e776b7b8ed87764fa1a02ba69ea5b7b8105d643e8147b3f6966b5bb583cc83c44ee4d0e6fd
SSDEEP

6144:KfTeW/s5GqrO5aXnfEGIXWPvZAOUyAzYflwbSEukkm+vti8Vs0BC+:FmcGqrOk86xMCwb5u7motHs0BC+

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 2684	2292	file.exe	30

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2640	2292	WerFault.exe	17
2716	2684	WerFault.exe	30

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2988	2292	file.exe	29
PID 2292 wrote to memory of 2988	2292	file.exe	29
PID 2292 wrote to memory of 2988	2292	file.exe	29
PID 2292 wrote to memory of 2988	2292	file.exe	29
PID 2292 wrote to memory of 2988	2292	file.exe	29
PID 2292 wrote to memory of 2988	2292	file.exe	29
PID 2292 wrote to memory of 2988	2292	file.exe	29
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2684	2292	file.exe	30
PID 2292 wrote to memory of 2640	2292	file.exe	31
PID 2292 wrote to memory of 2640	2292	file.exe	31
PID 2292 wrote to memory of 2640	2292	file.exe	31
PID 2292 wrote to memory of 2640	2292	file.exe	31
PID 2684 wrote to memory of 2716	2684	AppLaunch.exe	32
PID 2684 wrote to memory of 2716	2684	AppLaunch.exe	32
PID 2684 wrote to memory of 2716	2684	AppLaunch.exe	32
PID 2684 wrote to memory of 2716	2684	AppLaunch.exe	32
PID 2684 wrote to memory of 2716	2684	AppLaunch.exe	32
PID 2684 wrote to memory of 2716	2684	AppLaunch.exe	32
PID 2684 wrote to memory of 2716	2684	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 196
    3⤵
    - Program crash
    PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 84
  2⤵
  - Program crash
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2684-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2684-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2684-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2684-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2684-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2684-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2684-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2684-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads