16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe
Size

1.2MB
MD5

3aa3a8b330051d89a4464bf133824d94
SHA1

2695a9849acf00209505624b254ab68658fbfd05
SHA256

16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231
SHA512

1ccc83891e2ac27ae8dd7c5c4b9b712b4bfb2996334174d0871680285ce35570635747282545fb458f74d63a28ec456255efebf7c34b617fc13ce2b6f8a8bd2b
SSDEEP

24576:jZtJSfVC7okqSyaSBm5My7ZNiEnnq3n6GXhZ:jZtJS0p/S85MyOVXhZ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2168 set thread context of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2780	2084	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2168 wrote to memory of 2084	2168	16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe	29
PID 2084 wrote to memory of 2780	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2780	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2780	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2780	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2780	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2780	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2780	2084	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe
"C:\Users\Admin\AppData\Local\Temp\16ec33d8fc76a95937c2e02b7544ad29b5b443077ca1a05329af4ddc5f2d4231.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 200
    3⤵
    - Program crash
    PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-3-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2084-2-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2084-1-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2084-0-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2084-4-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2084-5-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2084-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2084-7-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2084-9-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2084-11-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads