156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe
Size

1.2MB
MD5

057a0f1fbedc775aacf74f713f7fd426
SHA1

6e58f222f68fe7ef3b2f6bb355e0799137fedced
SHA256

156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb
SHA512

2970bd0353388e0f3ec6de955fb8c5a2d47f753041e0234730dfc210758d9e46b7691555292b366bff740cfdb7bb4b7ed0d686e1ce519af15b62f066c9f6bc42
SSDEEP

24576:731rUbB61caZU1YezvhG2gT1jYvqfmBEPC/i:b1r+Icags281jWEPC/i

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3068	2772	WerFault.exe	31

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2080 wrote to memory of 2772	2080	156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe	31
PID 2772 wrote to memory of 3068	2772	AppLaunch.exe	32
PID 2772 wrote to memory of 3068	2772	AppLaunch.exe	32
PID 2772 wrote to memory of 3068	2772	AppLaunch.exe	32
PID 2772 wrote to memory of 3068	2772	AppLaunch.exe	32
PID 2772 wrote to memory of 3068	2772	AppLaunch.exe	32
PID 2772 wrote to memory of 3068	2772	AppLaunch.exe	32
PID 2772 wrote to memory of 3068	2772	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe
"C:\Users\Admin\AppData\Local\Temp\156f81e6d48e16ee1ee49abd80e98a723c860a403f2d1faa60e435ffeaec4abb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 200
    3⤵
    - Program crash
    PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2772-0-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/2772-1-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/2772-2-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/2772-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-5-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/2772-4-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/2772-7-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/2772-3-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/2772-9-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download
memory/2772-11-0x0000000000400000-0x0000000000509000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads