Analysis
-
max time kernel
139s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2023, 14:59
Static task
static1
1 signatures
General
-
Target
39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe
-
Size
276KB
-
MD5
c297aa1ef2039404792f5307483bb38d
-
SHA1
ecf50dabdf2967d1f43f382b821874e4052c41ba
-
SHA256
39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f
-
SHA512
950b9982bf640f2e3e7a0e5813a75670992b0d1fa45add57d7e4117e59e5f232873c2cebca015d2c04952328da73ce3e4cc58608aa38658ec55b6bb0f4a1a78d
-
SSDEEP
6144:Whh1KajWpVP06JT8JuvGVi494ZdEfeUSglIQKX3iJdgYrj:WlKajWh8EYKCfeU7ORX0hj
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1460 set thread context of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84 -
Program crash 1 IoCs
pid pid_target Process procid_target 3416 1460 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1460 wrote to memory of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84 PID 1460 wrote to memory of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84 PID 1460 wrote to memory of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84 PID 1460 wrote to memory of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84 PID 1460 wrote to memory of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84 PID 1460 wrote to memory of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84 PID 1460 wrote to memory of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84 PID 1460 wrote to memory of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84 PID 1460 wrote to memory of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84 PID 1460 wrote to memory of 3940 1460 39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe"C:\Users\Admin\AppData\Local\Temp\39020c51d77559b09e98057cb2c997e6af6b0d415462324333f0592d28ae640f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:3940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 1402⤵
- Program crash
PID:3416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1460 -ip 14601⤵PID:3220