fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe
Size

1.4MB
MD5

52d53277159b5b3adc7ce386b9c78c0b
SHA1

fc9cf0aed813493812103aaffe33c5de72ec4d6d
SHA256

fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc
SHA512

b9adf829d8c5c888e9b25030169140cea705be190e2f580ac92d89e82c804f44d949183c2a066725733ddc0e882ae222f5f0509c7e67bf50e3ba7cf0d87ade59
SSDEEP

24576:wwvSj9t6lif8NvmwKjMLu2wg1hb0sLP/8linHJQxl4oPGdU/WHoi3/Yf:5Sj9KGyvOiu2w8h7TwiHJQxl4oPGdUa8

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2240	2972	WerFault.exe	27
2744	3012	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 3012	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	29
PID 2972 wrote to memory of 2240	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	30
PID 2972 wrote to memory of 2240	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	30
PID 2972 wrote to memory of 2240	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	30
PID 2972 wrote to memory of 2240	2972	fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe	30
PID 3012 wrote to memory of 2744	3012	AppLaunch.exe	31
PID 3012 wrote to memory of 2744	3012	AppLaunch.exe	31
PID 3012 wrote to memory of 2744	3012	AppLaunch.exe	31
PID 3012 wrote to memory of 2744	3012	AppLaunch.exe	31
PID 3012 wrote to memory of 2744	3012	AppLaunch.exe	31
PID 3012 wrote to memory of 2744	3012	AppLaunch.exe	31
PID 3012 wrote to memory of 2744	3012	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe
"C:\Users\Admin\AppData\Local\Temp\fd3e5389b778bdbf2a185874ef792ace77a1ede6b2c758d662de8c43e70e9bfc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 200
    3⤵
    - Program crash
    PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 92
  2⤵
  - Program crash
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/3012-1-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/3012-3-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/3012-2-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/3012-5-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/3012-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3012-7-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/3012-4-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/3012-9-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download
memory/3012-11-0x0000000000400000-0x000000000053D000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads