e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe
Size

1.2MB
MD5

d73611ca509e3df6f539fa1402951811
SHA1

b1d3094add29bc7325a7f7eeed0d723bf2e7ae36
SHA256

e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30
SHA512

7040168b6936202dbd81fa807a666120cbed09144c8e20be3950750dde505c71a33b790c48ab24be965af8299451c3c4fac4f4ead36cab53d6710ec452ff2126
SSDEEP

24576:T74crraN9vX/M4w0C6syOXn6n1kAl+z9DZ6FhRnaS6zG:34crrcvX06OX6nei+DZSRnapG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2812 set thread context of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	3040	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 2812 wrote to memory of 3040	2812	e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe	29
PID 3040 wrote to memory of 2612	3040	AppLaunch.exe	30
PID 3040 wrote to memory of 2612	3040	AppLaunch.exe	30
PID 3040 wrote to memory of 2612	3040	AppLaunch.exe	30
PID 3040 wrote to memory of 2612	3040	AppLaunch.exe	30
PID 3040 wrote to memory of 2612	3040	AppLaunch.exe	30
PID 3040 wrote to memory of 2612	3040	AppLaunch.exe	30
PID 3040 wrote to memory of 2612	3040	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe
"C:\Users\Admin\AppData\Local\Temp\e87946fe7e0d900c39212c13c6adb1b4d7df1cddc6dbf47df24ef91ba832cb30.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 200
    3⤵
    - Program crash
    PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3040-7-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3040-5-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3040-4-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3040-3-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3040-2-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3040-9-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3040-1-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3040-0-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3040-11-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads