ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0deb

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05-10-2023 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe
Size

671KB
MD5

221bb71916e1e9d532ae7022869d55ae
SHA1

241dc48d97b2f7527c21f3bb78ab1646de099b18
SHA256

ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0deb
SHA512

14af6d828ccd7712b2ceb4ee8a2129ee4ae11a492034ec0f904edf4e4585ccb3e7f98fc54641d7443998c621ad49edba8654fc811351f7968f60b8d39500718b
SSDEEP

12288:jgN4/W78H0gxU2QYLMoXbCrcp2YhRLvLY9YhT6oc8kJrhr4QD2s0BC+:OUW7u0T2TL/XmqhhY9YV6oc8k7r4q0l

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	1852	WerFault.exe	27

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2056	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	29
PID 1852 wrote to memory of 2672	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	30
PID 1852 wrote to memory of 2672	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	30
PID 1852 wrote to memory of 2672	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	30
PID 1852 wrote to memory of 2672	1852	ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ec0898d88ee59ee97415deedbc28c6754a4bf83c1443d10e9cd0deeb219f0debexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 76
  2⤵
  - Program crash
  PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-3-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-4-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-2-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-1-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-5-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2056-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-8-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-10-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads