bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe
Size

1.4MB
MD5

50475fe66deafc575702b55a4407acf5
SHA1

a2be76ab47ad92e514649589d3a0c60e17268376
SHA256

bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416
SHA512

2bf45771d6f9ba82a7dab15ddf19f83a3a5dcb852fb74d724108f0eb696538c1410562af4bfec1d2f0507345d2d5278a930b29b18699113b3977d652920c40f2
SSDEEP

24576:/e1RCbHUKkt3+OizLFMWFeQdw44xVY7xGVCH5LPGXs0YwnXpoqbpmg5GXG:G1RCbW3+XFM3f3LYF2CHdGXs0YwXpoq/

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe

description	pid	process	target process
PID 1408 set thread context of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1284 2176 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
1284	2176	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exeAppLaunch.exe

description	pid	process	target process
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 1408 wrote to memory of 2176	1408	bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe	AppLaunch.exe
PID 2176 wrote to memory of 1284	2176	AppLaunch.exe	WerFault.exe
PID 2176 wrote to memory of 1284	2176	AppLaunch.exe	WerFault.exe
PID 2176 wrote to memory of 1284	2176	AppLaunch.exe	WerFault.exe
PID 2176 wrote to memory of 1284	2176	AppLaunch.exe	WerFault.exe
PID 2176 wrote to memory of 1284	2176	AppLaunch.exe	WerFault.exe
PID 2176 wrote to memory of 1284	2176	AppLaunch.exe	WerFault.exe
PID 2176 wrote to memory of 1284	2176	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe
"C:\Users\Admin\AppData\Local\Temp\bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 200
3⤵
- Program crash
PID:1284

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2176-1-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2176-2-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2176-3-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2176-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2176-7-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2176-5-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2176-4-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2176-9-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2176-11-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download