ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe
Size

1.0MB
MD5

bbd2ff1f19d1b7ae88cf0be6350fbe07
SHA1

03b354572268cce8394ceef6287a006426b6419d
SHA256

ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1
SHA512

ebdd2978bad79ae456ff0ca1068db4a40a0adb6fcb2510bfaf22e70199c1dfe653dae56bc21528a09845884d6485ae6a96c3c2ebea6f1c842425b3365599f76e
SSDEEP

12288:RoW5dPenEp953bXeWJOTfo8o+NFJiJRTTw7KuLpJR59i6gANyeVy+dP5:9rPenEp953bQfo8LnAT87D6gyGR

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1376 set thread context of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2572	1376	WerFault.exe	27
2676	2700	WerFault.exe	31

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2396	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	29
PID 1376 wrote to memory of 2396	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	29
PID 1376 wrote to memory of 2396	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	29
PID 1376 wrote to memory of 2396	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	29
PID 1376 wrote to memory of 2396	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	29
PID 1376 wrote to memory of 2396	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	29
PID 1376 wrote to memory of 2396	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	29
PID 1376 wrote to memory of 2360	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	30
PID 1376 wrote to memory of 2360	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	30
PID 1376 wrote to memory of 2360	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	30
PID 1376 wrote to memory of 2360	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	30
PID 1376 wrote to memory of 2360	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	30
PID 1376 wrote to memory of 2360	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	30
PID 1376 wrote to memory of 2360	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	30
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2700	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	31
PID 1376 wrote to memory of 2572	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	32
PID 1376 wrote to memory of 2572	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	32
PID 1376 wrote to memory of 2572	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	32
PID 1376 wrote to memory of 2572	1376	ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe	32
PID 2700 wrote to memory of 2676	2700	AppLaunch.exe	33
PID 2700 wrote to memory of 2676	2700	AppLaunch.exe	33
PID 2700 wrote to memory of 2676	2700	AppLaunch.exe	33
PID 2700 wrote to memory of 2676	2700	AppLaunch.exe	33
PID 2700 wrote to memory of 2676	2700	AppLaunch.exe	33
PID 2700 wrote to memory of 2676	2700	AppLaunch.exe	33
PID 2700 wrote to memory of 2676	2700	AppLaunch.exe	33

C:\Users\Admin\AppData\Local\Temp\ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe
"C:\Users\Admin\AppData\Local\Temp\ce15ea12f4f64cc602840302cf2a82169bb65746787cd9d0eadd58b45a5ab8d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 196
    3⤵
    - Program crash
    PID:2676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 72
  2⤵
  - Program crash
  PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2700-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2700-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2700-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads