392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe
Size

1.0MB
MD5

5d4b2242904f4f028bf3c3dc41d1b721
SHA1

a900d56389ac1ba6749f7e038828eb1d2bdccdf3
SHA256

392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac
SHA512

c28ea91360524f1960038f12fe8886e04e3d38a0148e2f0f88ee9e16adf7a11040c52850fc59d9cc6799adde56635a9d9d4ff9be6888513bc824fcab2a166147
SSDEEP

12288:doeDdPenEp953bXeu5W2fo8oBNFJQxBTTASKuLpv+aCBwMPC5:BJPenEp953bpfo8Un+TMSkBwMy

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2228	1900	WerFault.exe	13
2016	2420	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2420	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	29
PID 1900 wrote to memory of 2228	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	30
PID 1900 wrote to memory of 2228	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	30
PID 1900 wrote to memory of 2228	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	30
PID 1900 wrote to memory of 2228	1900	392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe	30
PID 2420 wrote to memory of 2016	2420	AppLaunch.exe	31
PID 2420 wrote to memory of 2016	2420	AppLaunch.exe	31
PID 2420 wrote to memory of 2016	2420	AppLaunch.exe	31
PID 2420 wrote to memory of 2016	2420	AppLaunch.exe	31
PID 2420 wrote to memory of 2016	2420	AppLaunch.exe	31
PID 2420 wrote to memory of 2016	2420	AppLaunch.exe	31
PID 2420 wrote to memory of 2016	2420	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe
"C:\Users\Admin\AppData\Local\Temp\392412a24936123d7ea07b2b7f3048d944c520e9c491f5498b2627d0a92146ac.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 196
    3⤵
    - Program crash
    PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 52
  2⤵
  - Program crash
  PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2420-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2420-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2420-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads