0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9

Analysis

max time kernel
120s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe
Size

1.2MB
MD5

fe3f38ecd2588f5859199841286083ae
SHA1

dbdb1f87ded800cc360c28968d01d42e21dd744f
SHA256

0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9
SHA512

8e0d9f22b13b0e85f6903468d5c86b4272e50d2c042520a81cb2ac668d9ce4920084e196799f9f43d17f026f8d31feb7e81e5f3eb24fd13c56651b0858f46dfc
SSDEEP

24576:jBuqRu53jCLkdw27qLL4WLz/liL+IUA5d/53OiFOr4UL6wzpwOYLG:NuqRq3Z7qLL4WLLliL+MHBNFOrjL6wzD

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	1892	WerFault.exe	30

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2372	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	29
PID 2432 wrote to memory of 2372	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	29
PID 2432 wrote to memory of 2372	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	29
PID 2432 wrote to memory of 2372	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	29
PID 2432 wrote to memory of 2372	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	29
PID 2432 wrote to memory of 2372	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	29
PID 2432 wrote to memory of 2372	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	29
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 2432 wrote to memory of 1892	2432	0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe	30
PID 1892 wrote to memory of 2288	1892	AppLaunch.exe	31
PID 1892 wrote to memory of 2288	1892	AppLaunch.exe	31
PID 1892 wrote to memory of 2288	1892	AppLaunch.exe	31
PID 1892 wrote to memory of 2288	1892	AppLaunch.exe	31
PID 1892 wrote to memory of 2288	1892	AppLaunch.exe	31
PID 1892 wrote to memory of 2288	1892	AppLaunch.exe	31
PID 1892 wrote to memory of 2288	1892	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe
"C:\Users\Admin\AppData\Local\Temp\0f55c7a42f1cbcb1bc18edcd516aef6b3fee31f46112a0d484b0d1bf5cb0a5c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2372
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 200
    3⤵
    - Program crash
    PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-0-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1892-1-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1892-2-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1892-5-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1892-3-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1892-4-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1892-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1892-7-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1892-9-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1892-11-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads