84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe
Size

285KB
MD5

50cfd587b6b276262bd63718c13ea648
SHA1

8f87f66c4ccfe33453da8150ce57360751403c64
SHA256

84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0
SHA512

e2e92e4e1cde03df354ecef85f739958e45a052d1611b24a6a0198ba07b043ddda18ab0da6b1f141ae8c953098db3f6087cecc782bf95724bcee9db80811c3a2
SSDEEP

6144:35IM+soGJ/+1nyTfXdinC2cWllUYmvvEMa4jVN4RPTyeJu:35IM+sonyAnC8l4vvEMbViRw

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2584	2392	WerFault.exe	17
2860	2676	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2676	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	29
PID 2392 wrote to memory of 2584	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	30
PID 2392 wrote to memory of 2584	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	30
PID 2392 wrote to memory of 2584	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	30
PID 2392 wrote to memory of 2584	2392	84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe	30
PID 2676 wrote to memory of 2860	2676	AppLaunch.exe	31
PID 2676 wrote to memory of 2860	2676	AppLaunch.exe	31
PID 2676 wrote to memory of 2860	2676	AppLaunch.exe	31
PID 2676 wrote to memory of 2860	2676	AppLaunch.exe	31
PID 2676 wrote to memory of 2860	2676	AppLaunch.exe	31
PID 2676 wrote to memory of 2860	2676	AppLaunch.exe	31
PID 2676 wrote to memory of 2860	2676	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe
"C:\Users\Admin\AppData\Local\Temp\84384eab13dadf12bf9fbaab8b25aa6ff84483dece60d592de674699eac428c0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 196
    3⤵
    - Program crash
    PID:2860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 136
  2⤵
  - Program crash
  PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2676-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2676-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2676-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2676-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2676-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2676-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2676-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2676-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2676-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2676-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads