45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302

General

Target

45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe
Size

1.4MB
MD5

26437fe7ff86cdb1b81cd9855b94a9ee
SHA1

df3c2de4a52841625e8f58c1493910524cbe8650
SHA256

45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302
SHA512

5c6174b9e68e49fd3a5bac7854b6b688a828dd6512f6e1006f4550e0f7b598bcc85d9332f96c491beb29aa0685b91ddf7e5aff61cac1830bd0e46be44c1468e2
SSDEEP

24576:YyJ1eopfuzUVGhsuUgZN3zMC8h/xjZ2cZQzaT5RM8t1goebRU7w5gwG:nJ1eopfuuYsuUgZN3zMCkgcOmT5RM8tp

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe

description	pid	process	target process
PID 1728 set thread context of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2800 3048 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
2800	3048	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exeAppLaunch.exe

description	pid	process	target process
PID 1728 wrote to memory of 2340	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2340	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2340	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2340	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2340	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2340	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2340	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2120	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2120	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2120	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2120	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2120	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2120	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 2120	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 1728 wrote to memory of 3048	1728	45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe	AppLaunch.exe
PID 3048 wrote to memory of 2800	3048	AppLaunch.exe	WerFault.exe
PID 3048 wrote to memory of 2800	3048	AppLaunch.exe	WerFault.exe
PID 3048 wrote to memory of 2800	3048	AppLaunch.exe	WerFault.exe
PID 3048 wrote to memory of 2800	3048	AppLaunch.exe	WerFault.exe
PID 3048 wrote to memory of 2800	3048	AppLaunch.exe	WerFault.exe
PID 3048 wrote to memory of 2800	3048	AppLaunch.exe	WerFault.exe
PID 3048 wrote to memory of 2800	3048	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe
"C:\Users\Admin\AppData\Local\Temp\45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2120

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 200
3⤵
- Program crash
PID:2800

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-3-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3048-2-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3048-1-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3048-0-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3048-4-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3048-5-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3048-7-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3048-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3048-9-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/3048-11-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing