e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6

Analysis

max time kernel
240s
max time network
290s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe
Size

700KB
MD5

5e1333740eb74f236eb7192331698ad7
SHA1

69039501fa630bed304595d5accfea9413cce1b2
SHA256

e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6
SHA512

4a7c7ffa38a67a5576e998ef920525f6057ede43ab6d28b22e8ecbd8ef873c20c695ad14563992ead4bb39037f5d24182dc4dc0c1c4831f00b8c2b6ee67d1f69
SSDEEP

6144:h6vGALXgBEIy8wluzNcq/PVucQpxjcTbFNgAhtrdX3wXQ835vfr:sHXgFysVucQpVCbFNlr+Xd3Br

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2680 set thread context of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2580	2680	WerFault.exe	11
3036	2668	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2668	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	28
PID 2680 wrote to memory of 2580	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	29
PID 2680 wrote to memory of 2580	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	29
PID 2680 wrote to memory of 2580	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	29
PID 2680 wrote to memory of 2580	2680	e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe	29
PID 2668 wrote to memory of 3036	2668	AppLaunch.exe	30
PID 2668 wrote to memory of 3036	2668	AppLaunch.exe	30
PID 2668 wrote to memory of 3036	2668	AppLaunch.exe	30
PID 2668 wrote to memory of 3036	2668	AppLaunch.exe	30
PID 2668 wrote to memory of 3036	2668	AppLaunch.exe	30
PID 2668 wrote to memory of 3036	2668	AppLaunch.exe	30
PID 2668 wrote to memory of 3036	2668	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe
"C:\Users\Admin\AppData\Local\Temp\e32e242cedf6b497379fe8da97f8a30f400be1c164258a0fa07169bb3dccbcf6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 196
    3⤵
    - Program crash
    PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 92
  2⤵
  - Program crash
  PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2668-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads