f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe
Size

700KB
MD5

b1e3238fda40c23f82e5ece57f34fab4
SHA1

49881e0d4ee22dd7baeb54b484094f903ec3ad9e
SHA256

f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484
SHA512

831f482b58ab6d3dd13df30d4a737b35b74e9c7eba285185c769af7650bb1e2484f14ffd6d22b2f290529a1f1b297cdd4468545af235878e481dfe5b4e669148
SSDEEP

6144:C6vGALXgBEIy8wluzNcq/PVucQpJ6gAeaPqke8A+MPfExD3Y0fjvvfr:bHXgFysVucQpJ6+PjnW3JLr

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2876	1724	WerFault.exe	27
2508	2612	WerFault.exe	30

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 940	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	29
PID 1724 wrote to memory of 940	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	29
PID 1724 wrote to memory of 940	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	29
PID 1724 wrote to memory of 940	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	29
PID 1724 wrote to memory of 940	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	29
PID 1724 wrote to memory of 940	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	29
PID 1724 wrote to memory of 940	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	29
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2612	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	30
PID 1724 wrote to memory of 2876	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	31
PID 1724 wrote to memory of 2876	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	31
PID 1724 wrote to memory of 2876	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	31
PID 1724 wrote to memory of 2876	1724	f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe	31
PID 2612 wrote to memory of 2508	2612	AppLaunch.exe	32
PID 2612 wrote to memory of 2508	2612	AppLaunch.exe	32
PID 2612 wrote to memory of 2508	2612	AppLaunch.exe	32
PID 2612 wrote to memory of 2508	2612	AppLaunch.exe	32
PID 2612 wrote to memory of 2508	2612	AppLaunch.exe	32
PID 2612 wrote to memory of 2508	2612	AppLaunch.exe	32
PID 2612 wrote to memory of 2508	2612	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe
"C:\Users\Admin\AppData\Local\Temp\f3505df94802d077db41aaecf8cd66f077837ca7481e4ab0ecf0d1d091f00484.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 196
    3⤵
    - Program crash
    PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 100
  2⤵
  - Program crash
  PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2612-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2612-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2612-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2612-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2612-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2612-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2612-11-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2612-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2612-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2612-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads