e8023b68d5a9c7c7dd7a0ac7a2026c7e4af92c48466a8977e3490723222ad9fd

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe
Size

364KB
MD5

6ab89a92531ac59f30f7229a21166d3a
SHA1

69575a527642b40f553b1b1edf49912eff0ee6c8
SHA256

e8023b68d5a9c7c7dd7a0ac7a2026c7e4af92c48466a8977e3490723222ad9fd
SHA512

eba8d4ff48448425bda74430d50c18501b1344625377082ff6c08793195a151df61ff838ab3207ebb7606b2e8c3b6a8046037ed64aea655b490a6970a6f99b3b
SSDEEP

6144:RG46fuYXChoQTjlFgLuCY1dRuAOFVFlywWmMksz80paGy6NW3wF82bJ5Zw8y0:RzYzXChdTbv1bu5FxWY87VbNW3wFH9zg

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2716	1636	WerFault.exe	16
2780	1468	WerFault.exe	27

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 1468	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	27
PID 1636 wrote to memory of 2716	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	30
PID 1636 wrote to memory of 2716	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	30
PID 1636 wrote to memory of 2716	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	30
PID 1636 wrote to memory of 2716	1636	SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe	30
PID 1468 wrote to memory of 2780	1468	AppLaunch.exe	31
PID 1468 wrote to memory of 2780	1468	AppLaunch.exe	31
PID 1468 wrote to memory of 2780	1468	AppLaunch.exe	31
PID 1468 wrote to memory of 2780	1468	AppLaunch.exe	31
PID 1468 wrote to memory of 2780	1468	AppLaunch.exe	31
PID 1468 wrote to memory of 2780	1468	AppLaunch.exe	31
PID 1468 wrote to memory of 2780	1468	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.KillProc2.21513.27780.23731.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 196
    3⤵
    - Program crash
    PID:2780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 52
  2⤵
  - Program crash
  PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1468-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1468-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1468-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1468-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1468-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1468-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1468-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1468-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1468-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads