2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7

Analysis

max time kernel
254s
max time network
318s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe
Size

365KB
MD5

4a0f1fa3d4dc02a898864d0060d71d08
SHA1

912b3dc6cb81d148341f58acf83d5d3be4d261ed
SHA256

2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7
SHA512

0df63bd9715a9d678eff0a3822d14adc69a543a7e7e7a87a438dd3f8a9e5a2a2dcaadd6260a495ef2dbfba5a0750bda42468570d28e3f9cc60b1c186182b6426
SSDEEP

6144:fn5frpxdonyq4zaG2u5AO8eKECRR9TubDvlwE5YYG5zuDquqp:fxrp0/9u5yeQRzgvecYuDquqp

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1676	2756	WerFault.exe	24
2616	2760	WerFault.exe	26

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 2760	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	26
PID 2756 wrote to memory of 1676	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	27
PID 2756 wrote to memory of 1676	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	27
PID 2756 wrote to memory of 1676	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	27
PID 2756 wrote to memory of 1676	2756	2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe	27
PID 2760 wrote to memory of 2616	2760	AppLaunch.exe	28
PID 2760 wrote to memory of 2616	2760	AppLaunch.exe	28
PID 2760 wrote to memory of 2616	2760	AppLaunch.exe	28
PID 2760 wrote to memory of 2616	2760	AppLaunch.exe	28
PID 2760 wrote to memory of 2616	2760	AppLaunch.exe	28
PID 2760 wrote to memory of 2616	2760	AppLaunch.exe	28
PID 2760 wrote to memory of 2616	2760	AppLaunch.exe	28

C:\Users\Admin\AppData\Local\Temp\2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe
"C:\Users\Admin\AppData\Local\Temp\2585265cd021683f9b0d041e618d5b920de34aa0161eb04f9ad632877d6541d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 196
    3⤵
    - Program crash
    PID:2616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 92
  2⤵
  - Program crash
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2760-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2760-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2760-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2760-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2760-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2760-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2760-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2760-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2760-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads