206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe
Size

1.4MB
MD5

26d2bdb96ec12bc5365bea79b5193a92
SHA1

9df12cec889ddb87cbcc4440743f7954925639de
SHA256

206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50
SHA512

7df7d3d04dca04b923ee9b4f9ad2b023735bb7e90bc8aec8adcfeb7f054b2f912f7af3d02992c3656b8ab756bc4c0e42c8029ee7c18472425e032f29156a847b
SSDEEP

24576:lzxSd8DMSCi0QgCyPyegrkjM6BNu0gw8+LlxnYINltAdDQcRBv8ozUXYf:jSd8Dd0jydrkjhuZwFfnYIBUDQcLv8Wh

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2348	3048	WerFault.exe	4
3068	1060	WerFault.exe	31

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 1060	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	31
PID 3048 wrote to memory of 2348	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	32
PID 3048 wrote to memory of 2348	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	32
PID 3048 wrote to memory of 2348	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	32
PID 3048 wrote to memory of 2348	3048	206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe	32
PID 1060 wrote to memory of 3068	1060	AppLaunch.exe	33
PID 1060 wrote to memory of 3068	1060	AppLaunch.exe	33
PID 1060 wrote to memory of 3068	1060	AppLaunch.exe	33
PID 1060 wrote to memory of 3068	1060	AppLaunch.exe	33
PID 1060 wrote to memory of 3068	1060	AppLaunch.exe	33
PID 1060 wrote to memory of 3068	1060	AppLaunch.exe	33
PID 1060 wrote to memory of 3068	1060	AppLaunch.exe	33

C:\Users\Admin\AppData\Local\Temp\206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe
"C:\Users\Admin\AppData\Local\Temp\206642eb2f40851e1e9b035c7ce869b83dadec13ed42872dd693a28448fb3c50_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 200
    3⤵
    - Program crash
    PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 92
  2⤵
  - Program crash
  PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-0-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-1-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-2-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-3-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-4-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-5-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1060-7-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-9-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/1060-11-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads