50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83

Analysis

max time kernel
120s
max time network
157s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe
Size

364KB
MD5

86e45d6d5870dbf97e9d47603e505b8a
SHA1

025ac51c72f27386468bdd3eaed2ea948ee11819
SHA256

50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83
SHA512

b8b674a78ad6a7469907aa612eda5e784976e6c1698945e059263214824b91e194fefa915fa9975a19a294452f86168be66feb245003a93dd9722d0b8979ae84
SSDEEP

6144:Q546fuYXChoQTjlFgLuCY1dRuAOc+xBisxlaNI06Opo7E5fvetw8y0:QOYzXChdTbv1burx0uMN2Vtw8y

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2664 set thread context of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2992	2664	WerFault.exe	2
2876	2680	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2680	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	29
PID 2664 wrote to memory of 2992	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	30
PID 2664 wrote to memory of 2992	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	30
PID 2664 wrote to memory of 2992	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	30
PID 2664 wrote to memory of 2992	2664	50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe	30
PID 2680 wrote to memory of 2876	2680	AppLaunch.exe	31
PID 2680 wrote to memory of 2876	2680	AppLaunch.exe	31
PID 2680 wrote to memory of 2876	2680	AppLaunch.exe	31
PID 2680 wrote to memory of 2876	2680	AppLaunch.exe	31
PID 2680 wrote to memory of 2876	2680	AppLaunch.exe	31
PID 2680 wrote to memory of 2876	2680	AppLaunch.exe	31
PID 2680 wrote to memory of 2876	2680	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe
"C:\Users\Admin\AppData\Local\Temp\50fd3d73b1a20a0eda417fef560572fe1461804970da0ee9767df819b444ec83.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 196
    3⤵
    - Program crash
    PID:2876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 52
  2⤵
  - Program crash
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2680-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2680-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2680-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2680-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2680-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2680-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2680-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2680-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2680-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads