7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe
Size

1.4MB
MD5

59f8166eedf41267a0d71434bdfa756e
SHA1

a593efa4f659bee2847ee7b28bbbec3cd3f802ca
SHA256

7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a
SHA512

14d44ee1b86510c454045238910c6cdd0b90a5bdded67ab522eafd28f6ac63c9a7fa2d658475a1662ec045fb9aaf405b38c8a482f2321a37ff83330960effe5b
SSDEEP

24576:V4PTATdfqY5YvxfrxPGSgUJj4/ZrCuP8HivB1ogWFwX0S/wt/1674LnG:SPTATdfN56frEUtHA3/kq1I/1c4LnG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe

description	pid	process	target process
PID 1624 set thread context of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2628 2228 WerFault.exe AppLaunch.exe

pid	pid_target	process	target process
2628	2228	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exeAppLaunch.exe

description	pid	process	target process
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 1624 wrote to memory of 2228	1624	7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe	AppLaunch.exe
PID 2228 wrote to memory of 2628	2228	AppLaunch.exe	WerFault.exe
PID 2228 wrote to memory of 2628	2228	AppLaunch.exe	WerFault.exe
PID 2228 wrote to memory of 2628	2228	AppLaunch.exe	WerFault.exe
PID 2228 wrote to memory of 2628	2228	AppLaunch.exe	WerFault.exe
PID 2228 wrote to memory of 2628	2228	AppLaunch.exe	WerFault.exe
PID 2228 wrote to memory of 2628	2228	AppLaunch.exe	WerFault.exe
PID 2228 wrote to memory of 2628	2228	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe
"C:\Users\Admin\AppData\Local\Temp\7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 200
3⤵
- Program crash
PID:2628

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-1-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2228-0-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2228-3-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2228-4-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2228-2-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2228-5-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2228-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2228-7-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2228-9-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2228-11-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download