5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe
Size

364KB
MD5

b3cc16b5685073e255cf46c2c319e261
SHA1

a007ced8d28a812782a4ffb3a2c69e20951f3be2
SHA256

5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d
SHA512

cb8012eacdde0356cf7d6af3de46282b60034ed63f7696b6f5fad2a0f9181ae85d1d758747bb8cbe0c6c0e9207f5e3fec791df2c0f0d1496834bfd45ef3bb510
SSDEEP

6144:n246fuYXChoQTjlFgLuCY1dRuAOvNL6zHcsl02URzdnv0w8y0:nDYzXChdTbv1buLLGPl02URzp0w8y

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3048	2252	WerFault.exe	27
1944	2596	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 2596	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	28
PID 2252 wrote to memory of 3048	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	29
PID 2252 wrote to memory of 3048	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	29
PID 2252 wrote to memory of 3048	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	29
PID 2252 wrote to memory of 3048	2252	5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe	29
PID 2596 wrote to memory of 1944	2596	AppLaunch.exe	30
PID 2596 wrote to memory of 1944	2596	AppLaunch.exe	30
PID 2596 wrote to memory of 1944	2596	AppLaunch.exe	30
PID 2596 wrote to memory of 1944	2596	AppLaunch.exe	30
PID 2596 wrote to memory of 1944	2596	AppLaunch.exe	30
PID 2596 wrote to memory of 1944	2596	AppLaunch.exe	30
PID 2596 wrote to memory of 1944	2596	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe
"C:\Users\Admin\AppData\Local\Temp\5a1a02d278ac73bbc7b471e75318d0dff20e85b99c03b8312abc52fce0f6aa1d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 196
    3⤵
    - Program crash
    PID:1944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 52
  2⤵
  - Program crash
  PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2596-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2596-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2596-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2596-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2596-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2596-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2596-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2596-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2596-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads