Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 04:31
Static task
static1
Behavioral task
behavioral1
Sample
bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe
Resource
win10v2004-20230915-en
General
-
Target
bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe
-
Size
1.4MB
-
MD5
50475fe66deafc575702b55a4407acf5
-
SHA1
a2be76ab47ad92e514649589d3a0c60e17268376
-
SHA256
bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416
-
SHA512
2bf45771d6f9ba82a7dab15ddf19f83a3a5dcb852fb74d724108f0eb696538c1410562af4bfec1d2f0507345d2d5278a930b29b18699113b3977d652920c40f2
-
SSDEEP
24576:/e1RCbHUKkt3+OizLFMWFeQdw44xVY7xGVCH5LPGXs0YwnXpoqbpmg5GXG:G1RCbW3+XFM3f3LYF2CHdGXs0YwXpoq/
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exedescription pid process target process PID 1408 set thread context of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1284 2176 WerFault.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exeAppLaunch.exedescription pid process target process PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 1408 wrote to memory of 2176 1408 bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe AppLaunch.exe PID 2176 wrote to memory of 1284 2176 AppLaunch.exe WerFault.exe PID 2176 wrote to memory of 1284 2176 AppLaunch.exe WerFault.exe PID 2176 wrote to memory of 1284 2176 AppLaunch.exe WerFault.exe PID 2176 wrote to memory of 1284 2176 AppLaunch.exe WerFault.exe PID 2176 wrote to memory of 1284 2176 AppLaunch.exe WerFault.exe PID 2176 wrote to memory of 1284 2176 AppLaunch.exe WerFault.exe PID 2176 wrote to memory of 1284 2176 AppLaunch.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe"C:\Users\Admin\AppData\Local\Temp\bf22c1bfd97f9c72994ec1ca4d95869e886946a5062ec5782e0be288ed490416.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 2003⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2176-0-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2176-1-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2176-2-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2176-3-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2176-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2176-7-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2176-5-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2176-4-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2176-9-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/2176-11-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB