2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 08:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe
Size

1.0MB
MD5

568a4fa9dfb56b83488d1e08f41893d0
SHA1

27c9c6ea02a5d321a4405d17c0793e030a6e3d56
SHA256

2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f
SHA512

ea0d4fdb41d633e56837280168af9388b9f16a2dde131fa10bcd70223a021f1305e35803e8351c2d2fb7a8983a2e5d862c06387da89313bfe041adddbe4ce346
SSDEEP

24576:wzPenEp953bZfo88n+T865rWJ5PFLSH2ItFL/Fmhu2:Qp953bN+m8aWPFLSH2ItFC

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2724	2340	WerFault.exe	27
2608	2336	WerFault.exe	30

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2596	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	29
PID 2340 wrote to memory of 2596	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	29
PID 2340 wrote to memory of 2596	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	29
PID 2340 wrote to memory of 2596	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	29
PID 2340 wrote to memory of 2596	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	29
PID 2340 wrote to memory of 2596	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	29
PID 2340 wrote to memory of 2596	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	29
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2336	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	30
PID 2340 wrote to memory of 2724	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	31
PID 2340 wrote to memory of 2724	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	31
PID 2340 wrote to memory of 2724	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	31
PID 2340 wrote to memory of 2724	2340	2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe	31
PID 2336 wrote to memory of 2608	2336	AppLaunch.exe	32
PID 2336 wrote to memory of 2608	2336	AppLaunch.exe	32
PID 2336 wrote to memory of 2608	2336	AppLaunch.exe	32
PID 2336 wrote to memory of 2608	2336	AppLaunch.exe	32
PID 2336 wrote to memory of 2608	2336	AppLaunch.exe	32
PID 2336 wrote to memory of 2608	2336	AppLaunch.exe	32
PID 2336 wrote to memory of 2608	2336	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe
"C:\Users\Admin\AppData\Local\Temp\2365d519c1a701feca4c260f44d44845bf3ced021d4e7ae283818da200d4927f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 196
    3⤵
    - Program crash
    PID:2608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 60
  2⤵
  - Program crash
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2336-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2336-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads