Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 20:43
Static task
static1
Behavioral task
behavioral1
Sample
3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe
Resource
win10v2004-20230915-en
General
-
Target
3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe
-
Size
1.4MB
-
MD5
f2e3c1ef365b44c714dec538dac33569
-
SHA1
d88123aeefec74548888932096b85141e4ae219b
-
SHA256
3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c
-
SHA512
7e648e3cea412fe4912a579a83c788fcf402a002907ffd54fbefbf8f9e7fb4b1ccc3e3c0a8bcdd34f0aa9f9999bafacf20da4b0cfb4d54bc7c63e2f55004a2ec
-
SSDEEP
24576:5m9ZqNfJohAqoQtAeoX1a3gv0ZZgNX69UN5f5WO2iJqeyEp123Dnb//u0Ydd1AG:A9ZqzohOIAe4qgv04NK9UNTWO2+qeykf
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exedescription pid process target process PID 2788 set thread context of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2212 2616 WerFault.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exeAppLaunch.exedescription pid process target process PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2788 wrote to memory of 2616 2788 3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe AppLaunch.exe PID 2616 wrote to memory of 2212 2616 AppLaunch.exe WerFault.exe PID 2616 wrote to memory of 2212 2616 AppLaunch.exe WerFault.exe PID 2616 wrote to memory of 2212 2616 AppLaunch.exe WerFault.exe PID 2616 wrote to memory of 2212 2616 AppLaunch.exe WerFault.exe PID 2616 wrote to memory of 2212 2616 AppLaunch.exe WerFault.exe PID 2616 wrote to memory of 2212 2616 AppLaunch.exe WerFault.exe PID 2616 wrote to memory of 2212 2616 AppLaunch.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe"C:\Users\Admin\AppData\Local\Temp\3f0c321365300bbae4fb0dd3c84690ede4e1af72bc8f5f9b11f8c4bdf1a00a3c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 2003⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2616-0-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2616-1-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2616-2-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2616-3-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2616-4-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2616-5-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2616-7-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2616-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2616-9-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/2616-11-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB