Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
General
-
Target
2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe
-
Size
378KB
-
MD5
08f8f6905fe56347e52d6d3fceb139d1
-
SHA1
b9f7a0e54f6636daafda87441188d923ec7b6878
-
SHA256
2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd
-
SHA512
97a9de3f48e243d0eacb20660e8442cc2cacab9d3212fd37e8dffdb1eaa519977a4744de96dce6604721c33175eca09a0a7046649719a9c923996db79c31652d
-
SSDEEP
6144:xc5frpxdonyq4zaG2u5AODeKbWggLkDN4XnJnyxyBicp4dVacfa3dTAiquqp:xKrp0/9u5hecWggLkWJny0iced3fIdTA
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2388 set thread context of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 -
Program crash 2 IoCs
pid pid_target Process procid_target 2796 2388 WerFault.exe 27 2520 2052 WerFault.exe 33 -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1624 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 28 PID 2388 wrote to memory of 1624 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 28 PID 2388 wrote to memory of 1624 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 28 PID 2388 wrote to memory of 1624 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 28 PID 2388 wrote to memory of 1624 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 28 PID 2388 wrote to memory of 1624 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 28 PID 2388 wrote to memory of 1624 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 28 PID 2388 wrote to memory of 1256 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 29 PID 2388 wrote to memory of 1256 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 29 PID 2388 wrote to memory of 1256 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 29 PID 2388 wrote to memory of 1256 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 29 PID 2388 wrote to memory of 1256 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 29 PID 2388 wrote to memory of 1256 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 29 PID 2388 wrote to memory of 1256 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 29 PID 2388 wrote to memory of 1888 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 30 PID 2388 wrote to memory of 1888 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 30 PID 2388 wrote to memory of 1888 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 30 PID 2388 wrote to memory of 1888 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 30 PID 2388 wrote to memory of 1888 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 30 PID 2388 wrote to memory of 1888 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 30 PID 2388 wrote to memory of 1888 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 30 PID 2388 wrote to memory of 1740 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 31 PID 2388 wrote to memory of 1740 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 31 PID 2388 wrote to memory of 1740 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 31 PID 2388 wrote to memory of 1740 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 31 PID 2388 wrote to memory of 1740 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 31 PID 2388 wrote to memory of 1740 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 31 PID 2388 wrote to memory of 1740 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 31 PID 2388 wrote to memory of 1552 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 32 PID 2388 wrote to memory of 1552 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 32 PID 2388 wrote to memory of 1552 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 32 PID 2388 wrote to memory of 1552 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 32 PID 2388 wrote to memory of 1552 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 32 PID 2388 wrote to memory of 1552 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 32 PID 2388 wrote to memory of 1552 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 32 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2052 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 33 PID 2388 wrote to memory of 2796 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 34 PID 2388 wrote to memory of 2796 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 34 PID 2388 wrote to memory of 2796 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 34 PID 2388 wrote to memory of 2796 2388 2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe 34 PID 2052 wrote to memory of 2520 2052 AppLaunch.exe 35 PID 2052 wrote to memory of 2520 2052 AppLaunch.exe 35 PID 2052 wrote to memory of 2520 2052 AppLaunch.exe 35 PID 2052 wrote to memory of 2520 2052 AppLaunch.exe 35 PID 2052 wrote to memory of 2520 2052 AppLaunch.exe 35 PID 2052 wrote to memory of 2520 2052 AppLaunch.exe 35 PID 2052 wrote to memory of 2520 2052 AppLaunch.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe"C:\Users\Admin\AppData\Local\Temp\2c026a07f91caf74492d59a3aabbfcd2336c9edd4ecf0dadcbb27b29aa3784fd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1624
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1256
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:1552
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1963⤵
- Program crash
PID:2520
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 1362⤵
- Program crash
PID:2796
-