66c130bac5a4641ee4975154fc4b2a0d750bcd7002000f5630371dd48ac5e395

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe
Size 356KB
Sample230930-qrtm9aeb38
SHA256 66c130bac5a4641ee4975154fc4b2a0d750bcd7002000f5630371dd48ac5e395
MD5 07ff88e40b384508ceb763ac6cb03b42
SHA1 eebf24c589c93fa7aa334bff603d5cdc9ce62b90
SHA512 0248d0fbc1f927760c1561105d391d1e78f89080bcc4d36bc978c509f0cabb4a3aeb48e971f436ede45f636cae5c1d7709a0e8dbdb829194be333a5be08d7d81
SSDEEP 6144:AoTeW/s5GqrO5aXnfEGIXWPvZAOXyxM+mAZUHwvo4IIuzarwOnnnMzX6DVs0BC+:0mcGqrOk86xV+mAZAwg4IIuzOnnne6B9
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2736	3048	WerFault.exe	27
696	2076	WerFault.exe	30

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1168	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	29
PID 3048 wrote to memory of 1168	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	29
PID 3048 wrote to memory of 1168	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	29
PID 3048 wrote to memory of 1168	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	29
PID 3048 wrote to memory of 1168	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	29
PID 3048 wrote to memory of 1168	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	29
PID 3048 wrote to memory of 1168	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	29
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2076	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	30
PID 3048 wrote to memory of 2736	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	31
PID 3048 wrote to memory of 2736	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	31
PID 3048 wrote to memory of 2736	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	31
PID 3048 wrote to memory of 2736	3048	SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe	31
PID 2076 wrote to memory of 696	2076	AppLaunch.exe	32
PID 2076 wrote to memory of 696	2076	AppLaunch.exe	32
PID 2076 wrote to memory of 696	2076	AppLaunch.exe	32
PID 2076 wrote to memory of 696	2076	AppLaunch.exe	32
PID 2076 wrote to memory of 696	2076	AppLaunch.exe	32
PID 2076 wrote to memory of 696	2076	AppLaunch.exe	32
PID 2076 wrote to memory of 696	2076	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.61510.5581.9729.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 196
    3⤵
    - Program crash
    PID:696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 84
  2⤵
  - Program crash
  PID:2736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2076-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2076-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2076-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2076-5-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2076-7-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2076-10-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2076-9-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2076-12-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2076-14-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads