0726922aeb5c83792a0a27697af885de587cd472a56d5e5e3b1ac0d8be6109fa

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Robert-Martin_Photo-jpg.exe
Size

622KB
MD5

76f9480b747d9746a8a00af59ebffdfc
SHA1

9a5d2f431c65eea92596e71eb85f7702b8925306
SHA256

0726922aeb5c83792a0a27697af885de587cd472a56d5e5e3b1ac0d8be6109fa
SHA512

b3c5b96a464971dcdc4bebeefa1fdd5903e78e7b6514d907cc506910a45c95c6525269d1956576157a322351258decb9c3e08d4778d36f7daa78a8f1582e1f59
SSDEEP

12288:tuMeDTYUcw8BvtousQDtWQ5v/WjI3ItU50p2vpZNqi6tytk7x:t4DTY8WGQ595v/Hn576tytk7x

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1336 set thread context of 2288	1336	Robert-Martin_Photo-jpg.exe	30

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2052	1336	WerFault.exe	18
2624	2288	WerFault.exe	30

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2288	1336	Robert-Martin_Photo-jpg.exe	30
PID 1336 wrote to memory of 2052	1336	Robert-Martin_Photo-jpg.exe	31
PID 1336 wrote to memory of 2052	1336	Robert-Martin_Photo-jpg.exe	31
PID 1336 wrote to memory of 2052	1336	Robert-Martin_Photo-jpg.exe	31
PID 1336 wrote to memory of 2052	1336	Robert-Martin_Photo-jpg.exe	31
PID 2288 wrote to memory of 2624	2288	AppLaunch.exe	32
PID 2288 wrote to memory of 2624	2288	AppLaunch.exe	32
PID 2288 wrote to memory of 2624	2288	AppLaunch.exe	32
PID 2288 wrote to memory of 2624	2288	AppLaunch.exe	32
PID 2288 wrote to memory of 2624	2288	AppLaunch.exe	32
PID 2288 wrote to memory of 2624	2288	AppLaunch.exe	32
PID 2288 wrote to memory of 2624	2288	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\Robert-Martin_Photo-jpg.exe
"C:\Users\Admin\AppData\Local\Temp\Robert-Martin_Photo-jpg.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 196
    3⤵
    - Program crash
    PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 136
  2⤵
  - Program crash
  PID:2052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-1-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2288-2-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2288-5-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2288-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2288-7-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2288-4-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2288-3-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2288-0-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2288-9-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2288-11-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads