901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f

Analysis

max time kernel
117s
max time network
156s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe
Size

1.4MB
MD5

ed633a2c3b62f6e3de6447100fa0d630
SHA1

aa12c3bdee46481fdf0f02c9ce0195b6218b6813
SHA256

901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f
SHA512

05ccbc49e161b442ecb0872479d084139000274a7c837c1e758ff8ba00f9805b110046a25a6408c6bd87b5cb227de294b4f1adb4628e6a6a936c2915834689b9
SSDEEP

24576:X6R9my7Hiw8FHtM6ft2K3eDdYuePuNgAunWA9253a2y5YoG:qR9myUhthz/7uNfAg53XyrG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2436 set thread context of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	2736	WerFault.exe	31

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2436 wrote to memory of 2736	2436	901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe	31
PID 2736 wrote to memory of 2680	2736	AppLaunch.exe	32
PID 2736 wrote to memory of 2680	2736	AppLaunch.exe	32
PID 2736 wrote to memory of 2680	2736	AppLaunch.exe	32
PID 2736 wrote to memory of 2680	2736	AppLaunch.exe	32
PID 2736 wrote to memory of 2680	2736	AppLaunch.exe	32
PID 2736 wrote to memory of 2680	2736	AppLaunch.exe	32
PID 2736 wrote to memory of 2680	2736	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe
"C:\Users\Admin\AppData\Local\Temp\901019a5871125f6e2244b2e7417230a75028d4ff0736464c796fd0c2a56bc2f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 200
    3⤵
    - Program crash
    PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2736-3-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2736-4-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2736-5-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2736-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2736-7-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2736-2-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2736-0-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2736-1-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2736-9-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2736-11-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads