998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe
Size

1.3MB
MD5

aec6e2c6915f1ade95f713c411a67abc
SHA1

db6c2797e127469fc31fca94bcbbd7b7f30873cc
SHA256

998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369
SHA512

fd3db79725b5031f4656330680f583e5672dfabe1a339d446eec7fa63f7eeddf96aecb9e9bbe9c7c8baa26cba9cd2a944b91b7e7c06ba9f03de84f42cf2c9214
SSDEEP

24576:f090NLtvam4tjMAE5ee4NSLsxNnorZwyvOWM1tlcNecZGInwhQ:f090NGjm5ee4NSgxS1Y71tlckFInwhQ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	2084	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 1900 wrote to memory of 2084	1900	998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe	28
PID 2084 wrote to memory of 3012	2084	AppLaunch.exe	29
PID 2084 wrote to memory of 3012	2084	AppLaunch.exe	29
PID 2084 wrote to memory of 3012	2084	AppLaunch.exe	29
PID 2084 wrote to memory of 3012	2084	AppLaunch.exe	29
PID 2084 wrote to memory of 3012	2084	AppLaunch.exe	29
PID 2084 wrote to memory of 3012	2084	AppLaunch.exe	29
PID 2084 wrote to memory of 3012	2084	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe
"C:\Users\Admin\AppData\Local\Temp\998b66ae07ceb7e07a142e964934e6939c3587cc15871a4c8c40f19cd3381369.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 200
    3⤵
    - Program crash
    PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-1-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-2-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-3-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-4-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-5-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2084-7-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-9-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-11-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads