Analysis
-
max time kernel
121s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 20:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe
-
Size
1.2MB
-
MD5
9ee3d132a5160d17dfb59b03105c8066
-
SHA1
d3f17b9eca03f18acc805516c9bfdc5392a7e94d
-
SHA256
2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057
-
SHA512
9d0a8af1d3a999a2961174048b653eae6762fc62f1845cbeee0b3184bea22b579686a4a540da640068f7cf5832645765cacab011da1cead17d0c9e2fa63451e9
-
SSDEEP
24576:s9q+Vovdoqnvtus5weoALArAMJ/MjBG7TAvNkN7DsrNz1gC4b4G:gq+VoCkvturlALItQBG/EN4IJ1d44G
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2792 set thread context of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 -
Program crash 1 IoCs
pid pid_target Process procid_target 2640 2716 WerFault.exe 32 -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2648 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 29 PID 2792 wrote to memory of 2648 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 29 PID 2792 wrote to memory of 2648 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 29 PID 2792 wrote to memory of 2648 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 29 PID 2792 wrote to memory of 2648 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 29 PID 2792 wrote to memory of 2648 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 29 PID 2792 wrote to memory of 2648 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 29 PID 2792 wrote to memory of 2656 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 30 PID 2792 wrote to memory of 2656 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 30 PID 2792 wrote to memory of 2656 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 30 PID 2792 wrote to memory of 2656 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 30 PID 2792 wrote to memory of 2656 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 30 PID 2792 wrote to memory of 2656 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 30 PID 2792 wrote to memory of 2656 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 30 PID 2792 wrote to memory of 2712 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 31 PID 2792 wrote to memory of 2712 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 31 PID 2792 wrote to memory of 2712 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 31 PID 2792 wrote to memory of 2712 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 31 PID 2792 wrote to memory of 2712 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 31 PID 2792 wrote to memory of 2712 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 31 PID 2792 wrote to memory of 2712 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 31 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2792 wrote to memory of 2716 2792 2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe 32 PID 2716 wrote to memory of 2640 2716 AppLaunch.exe 33 PID 2716 wrote to memory of 2640 2716 AppLaunch.exe 33 PID 2716 wrote to memory of 2640 2716 AppLaunch.exe 33 PID 2716 wrote to memory of 2640 2716 AppLaunch.exe 33 PID 2716 wrote to memory of 2640 2716 AppLaunch.exe 33 PID 2716 wrote to memory of 2640 2716 AppLaunch.exe 33 PID 2716 wrote to memory of 2640 2716 AppLaunch.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe"C:\Users\Admin\AppData\Local\Temp\2d0f85bc228d867386383abfb98f145d2ef21507e5409a3881148bb9efe9c057.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2648
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2712
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 2003⤵
- Program crash
PID:2640
-
-