fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967

Analysis

max time kernel
258s
max time network
319s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe
Size

364KB
MD5

1077157bf63eee9b2c0925865ed4d635
SHA1

f5543d8d0b3f0f5c72a68be552737eed1e0c6be0
SHA256

fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967
SHA512

93a645c2b6da3b8aa878cc1e86607ac0c4b710424f5f0ca30a3480a8b1c911205fd0f75195cdf0a5a6d20f613f369e4c847d59a27755423888bc6f2e21d34443
SSDEEP

6144:gi46fuYXChoQTjlFgLuCY1dRuAOITU9jjdfBC/OXoeQI5TfO4oKR3o8MMw8y0:gnYzXChdTbv1bu/9HGOf5oKR3oVMw8y

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1724	2548	WerFault.exe	17
2544	2488	WerFault.exe	28

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2772	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	27
PID 2548 wrote to memory of 2772	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	27
PID 2548 wrote to memory of 2772	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	27
PID 2548 wrote to memory of 2772	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	27
PID 2548 wrote to memory of 2772	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	27
PID 2548 wrote to memory of 2772	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	27
PID 2548 wrote to memory of 2772	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	27
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 2488	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	28
PID 2548 wrote to memory of 1724	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	29
PID 2548 wrote to memory of 1724	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	29
PID 2548 wrote to memory of 1724	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	29
PID 2548 wrote to memory of 1724	2548	fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe	29
PID 2488 wrote to memory of 2544	2488	AppLaunch.exe	30
PID 2488 wrote to memory of 2544	2488	AppLaunch.exe	30
PID 2488 wrote to memory of 2544	2488	AppLaunch.exe	30
PID 2488 wrote to memory of 2544	2488	AppLaunch.exe	30
PID 2488 wrote to memory of 2544	2488	AppLaunch.exe	30
PID 2488 wrote to memory of 2544	2488	AppLaunch.exe	30
PID 2488 wrote to memory of 2544	2488	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe
"C:\Users\Admin\AppData\Local\Temp\fdceb39a8719636afe732c6a5894dcdf1a305b8dde628ac3c4c3a1d625b54967.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 196
    3⤵
    - Program crash
    PID:2544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 60
  2⤵
  - Program crash
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2488-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2488-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2488-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2488-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2488-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2488-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2488-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2488-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2488-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2488-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads