25a6b5b6fc67ddb1838c50cd0146ac845f5a86e3620e7c463361f355d90dc4a8

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe
Size

372KB
MD5

2d5d8d55e461986b5f3245d0a73a6643
SHA1

755070b71b3fa2a8446256d0c0dac54be95b63fb
SHA256

b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6
SHA512

6f2948c711f63409ade4ced1512618c91e8a92972de39861642cb72aac19e944ac2adb7a0f46ab8a9e663da0702a8e70747eb5e3ded8b51b344a8e73cefafce0
SSDEEP

6144:Pq46fuYXChoQTjlFgLuCY1dRuAO3xkqJkcEsu1OGxkE7VRw8y0M:PPYzXChdTbv1buUqJMsXGyEVRw8yr

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2272 set thread context of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1264	2272	WerFault.exe	27
2384	2068	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 2068	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	28
PID 2272 wrote to memory of 1264	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	29
PID 2272 wrote to memory of 1264	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	29
PID 2272 wrote to memory of 1264	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	29
PID 2272 wrote to memory of 1264	2272	b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe	29
PID 2068 wrote to memory of 2384	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 2384	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 2384	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 2384	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 2384	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 2384	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 2384	2068	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe
"C:\Users\Admin\AppData\Local\Temp\b82895964dcd2bc25bd94d15882e352369d4a2e326dabccce89571f7a9c76cd6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 196
    3⤵
    - Program crash
    PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 52
  2⤵
  - Program crash
  PID:1264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2068-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads