11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe
Size

1.4MB
MD5

bb75feea9cdad0c5618080415ad25521
SHA1

873ed5c2d86ad3b88db06d1c872d7936bfc0d0d8
SHA256

11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de
SHA512

2357580d2069c59cb0e1fd14c6df83ab99825a2ac43481e06e4a2852cd4b96ff8dc93c7fbc06658a09a710f08294fbcb9684606a0e2e40a605e16ab78e7259ff
SSDEEP

24576:1ZtEL7tzApuwUzPhnaCiBV/WuRq+nSz1jDRVHJz2psYcKqdKMtTgqoKVDwELmqD3:1Zt6xs8auCjMpVzYlQKyTLx5hKOhZ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2936 set thread context of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2764	2648	WerFault.exe	30

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2612	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	29
PID 2936 wrote to memory of 2612	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	29
PID 2936 wrote to memory of 2612	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	29
PID 2936 wrote to memory of 2612	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	29
PID 2936 wrote to memory of 2612	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	29
PID 2936 wrote to memory of 2612	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	29
PID 2936 wrote to memory of 2612	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	29
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2936 wrote to memory of 2648	2936	11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe	30
PID 2648 wrote to memory of 2764	2648	AppLaunch.exe	31
PID 2648 wrote to memory of 2764	2648	AppLaunch.exe	31
PID 2648 wrote to memory of 2764	2648	AppLaunch.exe	31
PID 2648 wrote to memory of 2764	2648	AppLaunch.exe	31
PID 2648 wrote to memory of 2764	2648	AppLaunch.exe	31
PID 2648 wrote to memory of 2764	2648	AppLaunch.exe	31
PID 2648 wrote to memory of 2764	2648	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe
"C:\Users\Admin\AppData\Local\Temp\11d42982bc572d45fb03d576545fdcac76fc117b1543706ccef0f2b5f86394de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 200
    3⤵
    - Program crash
    PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-0-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2648-1-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2648-2-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2648-3-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2648-4-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2648-5-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2648-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2648-7-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2648-9-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download
memory/2648-11-0x0000000000400000-0x0000000000533000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads