b0bcee0dad0376bfcfa3b0f6fa3ccd6eb6fc2b52323280c463b7e53a3339585e

Analysis

max time kernel
241s
max time network
290s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe
Size

742KB
MD5

91c9ea17b096c3b5b012690d69e2f8d6
SHA1

bde6d582771ba0065e6599239243cf86e0d2fe50
SHA256

665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0
SHA512

257534852cff565e3da87df8f785f659c5eccf4bdb5107521e80b72f2c62932c76533f57a08f259989f21581694086d89d710a0f36d36dd9ff42a002e36d79cf
SSDEEP

12288:eN//yfYb5BIQZVth9bNgLmajQ/gsuhqt+GTDXWc1vqJ8HwcThN/n0Y9:uiuBtZvb2LR0/gO7LH1veATHj

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2788	2992	WerFault.exe	29

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2680	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	28
PID 2860 wrote to memory of 2680	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	28
PID 2860 wrote to memory of 2680	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	28
PID 2860 wrote to memory of 2680	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	28
PID 2860 wrote to memory of 2680	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	28
PID 2860 wrote to memory of 2680	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	28
PID 2860 wrote to memory of 2680	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	28
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2860 wrote to memory of 2992	2860	665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe	29
PID 2992 wrote to memory of 2788	2992	AppLaunch.exe	30
PID 2992 wrote to memory of 2788	2992	AppLaunch.exe	30
PID 2992 wrote to memory of 2788	2992	AppLaunch.exe	30
PID 2992 wrote to memory of 2788	2992	AppLaunch.exe	30
PID 2992 wrote to memory of 2788	2992	AppLaunch.exe	30
PID 2992 wrote to memory of 2788	2992	AppLaunch.exe	30
PID 2992 wrote to memory of 2788	2992	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe
"C:\Users\Admin\AppData\Local\Temp\665a25fe81677103220663a397237e33d3cf2835a4f2376447486c4e09189fc0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 200
    3⤵
    - Program crash
    PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2992-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2992-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2992-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2992-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2992-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2992-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2992-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2992-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2992-9-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2992-11-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads