08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4

Analysis

max time kernel
121s
max time network
156s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe
Size

365KB
MD5

4f9b17bc0e3be5600259da6879cb6032
SHA1

f40cb91a65b111559aaf28285fc39228844d0808
SHA256

08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4
SHA512

401b84388f02cc779ccd49796a9a479895aebda3fb46a354ee3b49d1b3e9873c16bb55db345cc60df007a4387c956893a909cf951d7d51138674593351444d39
SSDEEP

6144:ms5frpxdonyq4zaG2u5AOzeKQtsmHRFL6aqshFquqp:marp0/9u5ZextsSSUquqp

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2752 set thread context of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2808	2752	WerFault.exe	17
2552	3000	WerFault.exe	27

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 3000	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	27
PID 2752 wrote to memory of 2808	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	28
PID 2752 wrote to memory of 2808	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	28
PID 2752 wrote to memory of 2808	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	28
PID 2752 wrote to memory of 2808	2752	08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe	28
PID 3000 wrote to memory of 2552	3000	AppLaunch.exe	29
PID 3000 wrote to memory of 2552	3000	AppLaunch.exe	29
PID 3000 wrote to memory of 2552	3000	AppLaunch.exe	29
PID 3000 wrote to memory of 2552	3000	AppLaunch.exe	29
PID 3000 wrote to memory of 2552	3000	AppLaunch.exe	29
PID 3000 wrote to memory of 2552	3000	AppLaunch.exe	29
PID 3000 wrote to memory of 2552	3000	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe
"C:\Users\Admin\AppData\Local\Temp\08cfd147b0258e6df3525a4f936134a39fa14cfc9b66030f87aa70b3c2bb28e4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 196
    3⤵
    - Program crash
    PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 92
  2⤵
  - Program crash
  PID:2808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3000-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3000-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3000-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3000-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3000-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3000-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3000-5-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3000-9-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3000-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads