05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c

Analysis

max time kernel
122s
max time network
140s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe
Size

1.2MB
MD5

1887ee1fe7412938d0b50e5048e66022
SHA1

221ec027a401906ad86063ee058f029298989798
SHA256

05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c
SHA512

b2336235c24fe1d3df8e732bd10520d78043739701a6e40dd5f87ab094b1fd35556f22f1fed9bb6c722829b6395f560a39703229e475598b7f391dc0819fb092
SSDEEP

24576:VYtTYUw0/rq2RKjMWtjW5dXdswgy0nEGfyi0qdmGSygOTMrZV2RZ:VYtTYH0/O2vWNCrDgy0nEXi0bDbIZ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	3064	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3004 wrote to memory of 3064	3004	05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe	28
PID 3064 wrote to memory of 2956	3064	AppLaunch.exe	29
PID 3064 wrote to memory of 2956	3064	AppLaunch.exe	29
PID 3064 wrote to memory of 2956	3064	AppLaunch.exe	29
PID 3064 wrote to memory of 2956	3064	AppLaunch.exe	29
PID 3064 wrote to memory of 2956	3064	AppLaunch.exe	29
PID 3064 wrote to memory of 2956	3064	AppLaunch.exe	29
PID 3064 wrote to memory of 2956	3064	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe
"C:\Users\Admin\AppData\Local\Temp\05be32c1ac4d4f8080d6afa867e7a9cbdef17ca4b426a65580ae9b5f99b4741c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 200
    3⤵
    - Program crash
    PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3064-0-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/3064-2-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/3064-4-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/3064-5-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/3064-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3064-7-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/3064-3-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/3064-1-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/3064-9-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/3064-11-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads