e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe
Size

1.3MB
MD5

2f9db9707287c4b4f254b8f633e142f7
SHA1

25828847651a6d7237a42c22bef1facb91e87e8a
SHA256

e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35
SHA512

dd7cd355253d2481f54004d3b1dc29d750c10b8a03c87ef11c51aa88740a09a0b6c731bc267f18f7903c0df6562b8a0cee94858b385756476179f30a57da14bc
SSDEEP

24576:A09Zc1RlmrksZPZX+KBznrTXamwSU+X8PEyQ:A09Zc1RErksZPZuEnrTJwCsPNQ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2780 set thread context of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	2984	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2780 wrote to memory of 2984	2780	e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe	28
PID 2984 wrote to memory of 2760	2984	AppLaunch.exe	29
PID 2984 wrote to memory of 2760	2984	AppLaunch.exe	29
PID 2984 wrote to memory of 2760	2984	AppLaunch.exe	29
PID 2984 wrote to memory of 2760	2984	AppLaunch.exe	29
PID 2984 wrote to memory of 2760	2984	AppLaunch.exe	29
PID 2984 wrote to memory of 2760	2984	AppLaunch.exe	29
PID 2984 wrote to memory of 2760	2984	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe
"C:\Users\Admin\AppData\Local\Temp\e13954c59b81c6e9611350915e4e4948ab38f948e0591cfbd61de5656557cb35.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 200
    3⤵
    - Program crash
    PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2984-0-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2984-1-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2984-2-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2984-4-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2984-3-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2984-5-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2984-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2984-7-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2984-9-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2984-11-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads