188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe
Size

395KB
MD5

6c36812dc8c338185227e73ec3a4a635
SHA1

384dc4659bc2935d277922b2b1a8eed6caeb304a
SHA256

188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12
SHA512

1703b8617a065385fe9f87213b2ec9b0885d83fa564a379f9051597b6d0ee205603ee915e6b4a59a0280e7e1ecf463f6932dc63038c89275c445bf4fc057d3c9
SSDEEP

12288:aecU3SPJ/2fepqIQG+BgqRm/sdilfaoCYyUi:aePSvH+Bg0m/sdi5aoCYf

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2748	2020	WerFault.exe	17
2752	2580	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2580	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	29
PID 2020 wrote to memory of 2748	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	30
PID 2020 wrote to memory of 2748	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	30
PID 2020 wrote to memory of 2748	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	30
PID 2020 wrote to memory of 2748	2020	188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe	30
PID 2580 wrote to memory of 2752	2580	AppLaunch.exe	31
PID 2580 wrote to memory of 2752	2580	AppLaunch.exe	31
PID 2580 wrote to memory of 2752	2580	AppLaunch.exe	31
PID 2580 wrote to memory of 2752	2580	AppLaunch.exe	31
PID 2580 wrote to memory of 2752	2580	AppLaunch.exe	31
PID 2580 wrote to memory of 2752	2580	AppLaunch.exe	31
PID 2580 wrote to memory of 2752	2580	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe
"C:\Users\Admin\AppData\Local\Temp\188f7eba1edac29dbf84a753acea664397c6c3e3534c89d82c072495d151bd12.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 196
    3⤵
    - Program crash
    PID:2752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 92
  2⤵
  - Program crash
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2580-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2580-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2580-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2580-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2580-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2580-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2580-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2580-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2580-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2580-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads