Analysis
-
max time kernel
122s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 20:42
Static task
static1
Behavioral task
behavioral1
Sample
7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe
Resource
win10v2004-20230915-en
General
-
Target
7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe
-
Size
1.4MB
-
MD5
59f8166eedf41267a0d71434bdfa756e
-
SHA1
a593efa4f659bee2847ee7b28bbbec3cd3f802ca
-
SHA256
7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a
-
SHA512
14d44ee1b86510c454045238910c6cdd0b90a5bdded67ab522eafd28f6ac63c9a7fa2d658475a1662ec045fb9aaf405b38c8a482f2321a37ff83330960effe5b
-
SSDEEP
24576:V4PTATdfqY5YvxfrxPGSgUJj4/ZrCuP8HivB1ogWFwX0S/wt/1674LnG:SPTATdfN56frEUtHA3/kq1I/1c4LnG
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exedescription pid process target process PID 1624 set thread context of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2628 2228 WerFault.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exeAppLaunch.exedescription pid process target process PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 1624 wrote to memory of 2228 1624 7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe AppLaunch.exe PID 2228 wrote to memory of 2628 2228 AppLaunch.exe WerFault.exe PID 2228 wrote to memory of 2628 2228 AppLaunch.exe WerFault.exe PID 2228 wrote to memory of 2628 2228 AppLaunch.exe WerFault.exe PID 2228 wrote to memory of 2628 2228 AppLaunch.exe WerFault.exe PID 2228 wrote to memory of 2628 2228 AppLaunch.exe WerFault.exe PID 2228 wrote to memory of 2628 2228 AppLaunch.exe WerFault.exe PID 2228 wrote to memory of 2628 2228 AppLaunch.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe"C:\Users\Admin\AppData\Local\Temp\7a219c5c1e9f9ffa000b80f6dfa655b8709749b14300e3ebcfe5c2828405537a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 2003⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2228-1-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2228-0-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2228-3-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2228-4-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2228-2-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2228-5-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2228-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2228-7-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2228-9-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2228-11-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB