293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe
Size

1.4MB
MD5

aa5d521e471f1c0facdb7692bf2e3d6e
SHA1

f64beac708b6582aaa6368cdd32a1662843a318e
SHA256

293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e
SHA512

5e6662a52807fd79ee4118939ffcec5badfd9ac507c5c4467bdbbabb367864d6f680582df21f42f6187ed3df9ed0037d470683dbcfb7257e9a7a403c5ac8b40d
SSDEEP

24576:k8zXcarXADZyWncSgzGGgDsEnYVPjoCfBfxk06B35aEGnG:pzXcVZLXgzPIHn2PjoCfBfgBJAnG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3052 set thread context of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	1340	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 3052 wrote to memory of 1340	3052	293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe	29
PID 1340 wrote to memory of 2668	1340	AppLaunch.exe	30
PID 1340 wrote to memory of 2668	1340	AppLaunch.exe	30
PID 1340 wrote to memory of 2668	1340	AppLaunch.exe	30
PID 1340 wrote to memory of 2668	1340	AppLaunch.exe	30
PID 1340 wrote to memory of 2668	1340	AppLaunch.exe	30
PID 1340 wrote to memory of 2668	1340	AppLaunch.exe	30
PID 1340 wrote to memory of 2668	1340	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe
"C:\Users\Admin\AppData\Local\Temp\293c1e7a492952dfbea63aff32fd2b0135f8a9a7fbf0b29dcedc4b18485fbf1e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 200
    3⤵
    - Program crash
    PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-0-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1340-2-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1340-1-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1340-3-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1340-4-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1340-5-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1340-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1340-8-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1340-10-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1340-12-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads