fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe
Size

1.2MB
MD5

d1fe87b968d82a18079d364fbacd925c
SHA1

1c0a756cd3aeb46dd9cc68b27ce5d8e14895d635
SHA256

fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a
SHA512

36b268b08cf3ec4897faf21fe0974aa2208ef144a7f8235248bc0e197dc01f3dc758ac23f9e3d25a02889c7a7d178fa5ea9eecda61dcfd22ae8b4cfaa08358a2
SSDEEP

24576:k/84HcyCYwmdpQHAZ6MEf/k19o0HxSFsNQe4XdB7xxX16G:e84HZ+OuHAZI8LrckQe4XdB7/X8G

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2468 set thread context of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	2428	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2468 wrote to memory of 2428	2468	fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe	29
PID 2428 wrote to memory of 2784	2428	AppLaunch.exe	32
PID 2428 wrote to memory of 2784	2428	AppLaunch.exe	32
PID 2428 wrote to memory of 2784	2428	AppLaunch.exe	32
PID 2428 wrote to memory of 2784	2428	AppLaunch.exe	32
PID 2428 wrote to memory of 2784	2428	AppLaunch.exe	32
PID 2428 wrote to memory of 2784	2428	AppLaunch.exe	32
PID 2428 wrote to memory of 2784	2428	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe
"C:\Users\Admin\AppData\Local\Temp\fc9fe514f85f4c49194475bba840d353d153d3d9f73f44e8441e7619445bf58a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 200
    3⤵
    - Program crash
    PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-0-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2428-4-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2428-3-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2428-5-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2428-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2428-7-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2428-2-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2428-1-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2428-9-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/2428-11-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads