Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 20:40
Static task
static1
Behavioral task
behavioral1
Sample
45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe
Resource
win10v2004-20230915-en
General
-
Target
45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe
-
Size
1.4MB
-
MD5
26437fe7ff86cdb1b81cd9855b94a9ee
-
SHA1
df3c2de4a52841625e8f58c1493910524cbe8650
-
SHA256
45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302
-
SHA512
5c6174b9e68e49fd3a5bac7854b6b688a828dd6512f6e1006f4550e0f7b598bcc85d9332f96c491beb29aa0685b91ddf7e5aff61cac1830bd0e46be44c1468e2
-
SSDEEP
24576:YyJ1eopfuzUVGhsuUgZN3zMC8h/xjZ2cZQzaT5RM8t1goebRU7w5gwG:nJ1eopfuuYsuUgZN3zMCkgcOmT5RM8tp
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exedescription pid process target process PID 1728 set thread context of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2800 3048 WerFault.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exeAppLaunch.exedescription pid process target process PID 1728 wrote to memory of 2340 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2340 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2340 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2340 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2340 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2340 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2340 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2120 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2120 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2120 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2120 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2120 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2120 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 2120 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 1728 wrote to memory of 3048 1728 45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe AppLaunch.exe PID 3048 wrote to memory of 2800 3048 AppLaunch.exe WerFault.exe PID 3048 wrote to memory of 2800 3048 AppLaunch.exe WerFault.exe PID 3048 wrote to memory of 2800 3048 AppLaunch.exe WerFault.exe PID 3048 wrote to memory of 2800 3048 AppLaunch.exe WerFault.exe PID 3048 wrote to memory of 2800 3048 AppLaunch.exe WerFault.exe PID 3048 wrote to memory of 2800 3048 AppLaunch.exe WerFault.exe PID 3048 wrote to memory of 2800 3048 AppLaunch.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe"C:\Users\Admin\AppData\Local\Temp\45ae5714d97c8e7f92121fb5ee069174e1fb7f39994f3379b918f1b91bb90302.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 2003⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3048-3-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/3048-2-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/3048-1-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/3048-0-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/3048-4-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/3048-5-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/3048-7-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/3048-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/3048-9-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB
-
memory/3048-11-0x0000000000400000-0x0000000000531000-memory.dmpFilesize
1.2MB