d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe
Size

364KB
MD5

80852e1ef80a7c4eb56a78554be11a37
SHA1

ae5f358ddb1c01668d02ade390a805f0c1ed209d
SHA256

d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729
SHA512

5d52831352b9b0026b3fb68a497ae919cd49ece58bc46908bd3095e9fd5ca268940004d76bba4fe988543b7618900e1174f468501d7472ac65cc873391aaa1ba
SSDEEP

6144:qzc46fuYXChoQTjlFgLuCY1dRuAO6T4ozYIUv2wg9ct1U5B5gjhAsw8y0:qZYzXChdTbv1buE4uzFwg9ctiBq1w8y

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1732	1900	WerFault.exe	27
1940	2080	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 2080	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	28
PID 1900 wrote to memory of 1732	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	29
PID 1900 wrote to memory of 1732	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	29
PID 1900 wrote to memory of 1732	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	29
PID 1900 wrote to memory of 1732	1900	d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe	29
PID 2080 wrote to memory of 1940	2080	AppLaunch.exe	30
PID 2080 wrote to memory of 1940	2080	AppLaunch.exe	30
PID 2080 wrote to memory of 1940	2080	AppLaunch.exe	30
PID 2080 wrote to memory of 1940	2080	AppLaunch.exe	30
PID 2080 wrote to memory of 1940	2080	AppLaunch.exe	30
PID 2080 wrote to memory of 1940	2080	AppLaunch.exe	30
PID 2080 wrote to memory of 1940	2080	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe
"C:\Users\Admin\AppData\Local\Temp\d3bf8e89033d6d5c4e910b1e8edd75f9252b4915ca79819250835aeb5f100729.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 196
    3⤵
    - Program crash
    PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 52
  2⤵
  - Program crash
  PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2080-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2080-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2080-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2080-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2080-6-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2080-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2080-8-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2080-10-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2080-12-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads