eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe
Size

1.2MB
MD5

9cb509a501dca0ca4bd43e7bd8800319
SHA1

8800bb6f3df45a90a6f581b4cd8bd22cd4962ffd
SHA256

eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db
SHA512

b5e025194912f27c8474448476b816f332a41ce508cdf6c0e32f5a7a01293cdbe8d833dc1f8f09c121c3eccd8821aec75181cdd96887fa63b0cc4b14fb916294
SSDEEP

24576:MZtxDwqN5sh/Y7VH8pdBF9lpQyz3u9hEhbfx/vhZ:MZtRH01oyzuAtVhZ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	1692	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 2252 wrote to memory of 1692	2252	eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe	29
PID 1692 wrote to memory of 2608	1692	AppLaunch.exe	30
PID 1692 wrote to memory of 2608	1692	AppLaunch.exe	30
PID 1692 wrote to memory of 2608	1692	AppLaunch.exe	30
PID 1692 wrote to memory of 2608	1692	AppLaunch.exe	30
PID 1692 wrote to memory of 2608	1692	AppLaunch.exe	30
PID 1692 wrote to memory of 2608	1692	AppLaunch.exe	30
PID 1692 wrote to memory of 2608	1692	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe
"C:\Users\Admin\AppData\Local\Temp\eb105aa3dd9eeca6ea432a8f1e023b96707dd39c1a5ebdb0c7466e53b08dd7db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 200
    3⤵
    - Program crash
    PID:2608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-0-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1692-1-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1692-4-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1692-5-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1692-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1692-7-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1692-3-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1692-2-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1692-9-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1692-11-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads