Analysis
-
max time kernel
37s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 20:44
Static task
static1
Behavioral task
behavioral1
Sample
4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe
Resource
win10v2004-20230915-en
General
-
Target
4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe
-
Size
1.4MB
-
MD5
877cee0812b62784087c9cb85630c459
-
SHA1
a47caaa4979639e756e1431a3e915e84710838e6
-
SHA256
4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4
-
SHA512
ba8272faed2b3e751b5ed8aeb9c0767e4c031184414e3090e324f9e42adfbd98d41758478a9d52b0cd75610460d7e195a7e4e3fe5fa130dcbcf4b89f378d6e33
-
SSDEEP
24576:c4PTAQxFdzHS1QSABeg2UChnVOTtAXIFVHmnxp4o6AQC6bxW843Nu9C8nsG:lPTAQbRS1nAYZBhnrH6ACGu9CKsG
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exedescription pid process target process PID 1020 set thread context of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2684 2880 WerFault.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exeAppLaunch.exedescription pid process target process PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 1020 wrote to memory of 2880 1020 4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe AppLaunch.exe PID 2880 wrote to memory of 2684 2880 AppLaunch.exe WerFault.exe PID 2880 wrote to memory of 2684 2880 AppLaunch.exe WerFault.exe PID 2880 wrote to memory of 2684 2880 AppLaunch.exe WerFault.exe PID 2880 wrote to memory of 2684 2880 AppLaunch.exe WerFault.exe PID 2880 wrote to memory of 2684 2880 AppLaunch.exe WerFault.exe PID 2880 wrote to memory of 2684 2880 AppLaunch.exe WerFault.exe PID 2880 wrote to memory of 2684 2880 AppLaunch.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe"C:\Users\Admin\AppData\Local\Temp\4fad1aa56d92a13d529742673d6a35790a171c116e785e33efde4bb4e0b317c4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 2003⤵
- Program crash
PID:2684