f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe
Size

423KB
MD5

ee156506a87b4c73ad2bf5c61e7cbfdd
SHA1

3313b9ef9446555ea8b1630a46dea525af31bde3
SHA256

f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f
SHA512

505b206de48f17bfb5d9f6ab3b49c48aa85945ebf904b8bc17736259e5af2b86797dfadafa751ea8946cf1d696ddb888cc27a05746b8eee11bf76090cb462610
SSDEEP

12288:yDPxf1XFBC2JQCJBn5kBydkUGTHoOcTI1jrlS:yDpNVBfZ5eBZcTI1jrlS

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2140 set thread context of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2328	2140	WerFault.exe	27
2340	2296	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2296	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	28
PID 2140 wrote to memory of 2328	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	29
PID 2140 wrote to memory of 2328	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	29
PID 2140 wrote to memory of 2328	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	29
PID 2140 wrote to memory of 2328	2140	f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe	29
PID 2296 wrote to memory of 2340	2296	AppLaunch.exe	30
PID 2296 wrote to memory of 2340	2296	AppLaunch.exe	30
PID 2296 wrote to memory of 2340	2296	AppLaunch.exe	30
PID 2296 wrote to memory of 2340	2296	AppLaunch.exe	30
PID 2296 wrote to memory of 2340	2296	AppLaunch.exe	30
PID 2296 wrote to memory of 2340	2296	AppLaunch.exe	30
PID 2296 wrote to memory of 2340	2296	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe
"C:\Users\Admin\AppData\Local\Temp\f451814bd5c3d2240815a277a0663b8e57d0504cbd96f489e20cd1f1ab100e2f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 196
    3⤵
    - Program crash
    PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 136
  2⤵
  - Program crash
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2296-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2296-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads