cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe
Size

396KB
MD5

d5e8f3eecf01912d8f33a1fa85f187cd
SHA1

7e2c3652dfe1e9aea941ac27c5a1a0adc9609590
SHA256

cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be
SHA512

fe2858a221f5ffaa44860d386f10ce33cc43acc5b903793d51c27b2244d62a98142298e44adb7e89637a0b478fd26cd51c25d4ee870e57a7c791443df03ada15
SSDEEP

12288:vNCdqW5sEe2uug/gPLR1qGu7cFu+u+u+u8hGC9wh:vNCt5vDL3PLFnnnNhGVh

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2676	1932	WerFault.exe	27
2328	2116	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2116	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	28
PID 1932 wrote to memory of 2676	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	29
PID 1932 wrote to memory of 2676	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	29
PID 1932 wrote to memory of 2676	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	29
PID 1932 wrote to memory of 2676	1932	cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe	29
PID 2116 wrote to memory of 2328	2116	AppLaunch.exe	30
PID 2116 wrote to memory of 2328	2116	AppLaunch.exe	30
PID 2116 wrote to memory of 2328	2116	AppLaunch.exe	30
PID 2116 wrote to memory of 2328	2116	AppLaunch.exe	30
PID 2116 wrote to memory of 2328	2116	AppLaunch.exe	30
PID 2116 wrote to memory of 2328	2116	AppLaunch.exe	30
PID 2116 wrote to memory of 2328	2116	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe
"C:\Users\Admin\AppData\Local\Temp\cdc44cb94f2c7a7094efa618ca57da207ce22eedcbaed1a63a298a363b5a49be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 196
    3⤵
    - Program crash
    PID:2328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 52
  2⤵
  - Program crash
  PID:2676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2116-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2116-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2116-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2116-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2116-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2116-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2116-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2116-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2116-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads