2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe
Size

1.4MB
MD5

1179f60ef3ca68ce7dc51abaa7a4f956
SHA1

8200951d968115f80d22732100c614b052b98498
SHA256

2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85
SHA512

8e942078acf3e70e34cfc9e90acf9f9a68c9698e5acac5305e30767f78566607ba2206064414664be1755da15506574bd69cee9568dadba37633189709bdab2c
SSDEEP

24576:509CCRqXbsn6oFiKwvIRbs0p38BBipHuuv7F3UQoXJ937O2mKQ:509CCUrAewRI9SuKFEQW93ZQ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1396 set thread context of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2764	2584	WerFault.exe	30

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 1704	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	28
PID 1396 wrote to memory of 1704	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	28
PID 1396 wrote to memory of 1704	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	28
PID 1396 wrote to memory of 1704	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	28
PID 1396 wrote to memory of 1704	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	28
PID 1396 wrote to memory of 1704	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	28
PID 1396 wrote to memory of 1704	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	28
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 1396 wrote to memory of 2584	1396	2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe	30
PID 2584 wrote to memory of 2764	2584	AppLaunch.exe	31
PID 2584 wrote to memory of 2764	2584	AppLaunch.exe	31
PID 2584 wrote to memory of 2764	2584	AppLaunch.exe	31
PID 2584 wrote to memory of 2764	2584	AppLaunch.exe	31
PID 2584 wrote to memory of 2764	2584	AppLaunch.exe	31
PID 2584 wrote to memory of 2764	2584	AppLaunch.exe	31
PID 2584 wrote to memory of 2764	2584	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe
"C:\Users\Admin\AppData\Local\Temp\2c4bee4a367d7d47452a5e1231d14b97723f37f1ab6741638c6d7c45dfd0fc85.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 200
    3⤵
    - Program crash
    PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-0-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2584-1-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2584-2-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2584-3-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2584-4-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2584-5-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2584-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2584-7-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2584-9-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download
memory/2584-11-0x0000000000400000-0x000000000053A000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads