c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe
Size

365KB
MD5

6a4be4984268b8a62d6c96fc5cf05069
SHA1

d3ee4ba3257107b81c2f2016020acf2008be2c34
SHA256

c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5
SHA512

2f692913d946b7f2dce0d0cda556b1832ffdda018b74fdd440e1c74df67f67080ad88904a0226f6cbd7c3c4cccf068ca89767120e14271e04c51f17feffff7ac
SSDEEP

6144:sD5frpxdonyq4zaG2u5AONeKfdTTmBiT1K+3FLrgquqp:sdrp0/9u5TeAHmsvgquqp

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2088 set thread context of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2328	2088	WerFault.exe	9
2724	2012	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2012	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	28
PID 2088 wrote to memory of 2328	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	29
PID 2088 wrote to memory of 2328	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	29
PID 2088 wrote to memory of 2328	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	29
PID 2088 wrote to memory of 2328	2088	c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe	29
PID 2012 wrote to memory of 2724	2012	AppLaunch.exe	30
PID 2012 wrote to memory of 2724	2012	AppLaunch.exe	30
PID 2012 wrote to memory of 2724	2012	AppLaunch.exe	30
PID 2012 wrote to memory of 2724	2012	AppLaunch.exe	30
PID 2012 wrote to memory of 2724	2012	AppLaunch.exe	30
PID 2012 wrote to memory of 2724	2012	AppLaunch.exe	30
PID 2012 wrote to memory of 2724	2012	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe
"C:\Users\Admin\AppData\Local\Temp\c9857074eff8cadca2b6d83179dee505831b02ca629b78dc824f8bd86b0f88e5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 196
    3⤵
    - Program crash
    PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 92
  2⤵
  - Program crash
  PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2012-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2012-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2012-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2012-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2012-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2012-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2012-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2012-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2012-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads