448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe
Size

1.2MB
MD5

9f84fdb05cc4534d6421d2a652a92a39
SHA1

a5eb895a6acb05b0a91565cc330d24feec6bceab
SHA256

448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0
SHA512

ec827dbca47aa50fcc6ad7e629326d76ee4e11c76ac2a48af086b01857369ef5018cf58b98f64535888b4804967abeba1f5547336cb074352ce63d4500ce5af6
SSDEEP

24576:J74cr9pNvxrS8r8o884vYjfT+45gE9d0wfWoDEQquDLTNRV6HG:t4cr9HVS8F8nvYbT+45gE9djW7MDp6HG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2796	2628	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 900 wrote to memory of 2628	900	448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe	29
PID 2628 wrote to memory of 2796	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2796	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2796	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2796	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2796	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2796	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2796	2628	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe
"C:\Users\Admin\AppData\Local\Temp\448f631bdfbcec0ac93bd2bbdaf60f9f25b6c1b838b2f073acafc6edbf3644d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 200
    3⤵
    - Program crash
    PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-0-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2628-2-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2628-3-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2628-5-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2628-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2628-7-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2628-4-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2628-1-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2628-9-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2628-11-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads