f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe
Size

365KB
MD5

22d11081c350680d752cf1b97f338970
SHA1

8d9caf348d7b3fa75ab6d8dddc378ba278bf1031
SHA256

f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded
SHA512

3414fb7f0afb091e1aa34265381ba01ce96e6c8adf569b77134bb5a8c20be58cfb377034416778301f74ec5716ee223729f17fdac4cc1183472ec4ab2f46c621
SSDEEP

6144:9+5frpxdonyq4zaG2u5AO2eKJNkCHcGPt4h5AeVM7Qgmquqp:9wrp0/9u54e6NFHneVMUHquqp

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2280 set thread context of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3008	2280	WerFault.exe	27
3012	2068	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 2068	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	28
PID 2280 wrote to memory of 3008	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	29
PID 2280 wrote to memory of 3008	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	29
PID 2280 wrote to memory of 3008	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	29
PID 2280 wrote to memory of 3008	2280	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	29
PID 2068 wrote to memory of 3012	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 3012	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 3012	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 3012	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 3012	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 3012	2068	AppLaunch.exe	30
PID 2068 wrote to memory of 3012	2068	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe
"C:\Users\Admin\AppData\Local\Temp\f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 196
    3⤵
    - Program crash
    PID:3012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 92
  2⤵
  - Program crash
  PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2068-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2068-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads