54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15

Analysis

max time kernel
9s
max time network
36s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe
Size

365KB
MD5

a0448f673e7a2eb3882fae3135a8371d
SHA1

5771f62bb64ed8c627c86f8cdde84ad1abcac440
SHA256

54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15
SHA512

498d2b3b37928539de75db0167434dc62498d8a8644af47f8aaefbb3f8ce2bc2af21798a90857550969793d3ed4c32ad32853d0c4e26ac260bd4865a9073c8d1
SSDEEP

6144:2a5frpxdonyq4zaG2u5AOfeKQKAhj7I4HdwvBL7Dquqp:28rp0/9u5JeJKAhj6quqp

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2640	1996	WerFault.exe	15
2712	2684	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2684	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	28
PID 1996 wrote to memory of 2640	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	29
PID 1996 wrote to memory of 2640	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	29
PID 1996 wrote to memory of 2640	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	29
PID 1996 wrote to memory of 2640	1996	54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe	29
PID 2684 wrote to memory of 2712	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2712	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2712	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2712	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2712	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2712	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2712	2684	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe
"C:\Users\Admin\AppData\Local\Temp\54cca46adda2d261c5e3586cfb8f3bc547da46add6d924ada554fd5d9ddb6c15.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 196
    3⤵
    - Program crash
    PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 92
  2⤵
  - Program crash
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2684-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2684-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2684-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2684-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2684-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2684-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2684-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2684-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads