d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe
Size

742KB
MD5

a6d704413ca620fc8e39e842cbb10bc7
SHA1

91e5019955a9d7f9122a15c196da222263a11aa9
SHA256

d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942
SHA512

8e089bba264ec9735e9cfa6cbe6b8bf9afeb2d43df049e707aa2c6fced0dd1a90a99bcd900e06099ba7d8b411fdd32b75d3a8261c8f34ca08f68166dd6a6e376
SSDEEP

12288:Cd//yfYb5BIQZVtTddwNEflmJ1xq8n7mtPFxheiHX5iopG9OuTyfFuO9:iiuBtZ5ddoJ1tyxFxf0opG9m

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1352	1728	WerFault.exe	30

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1960	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	29
PID 2988 wrote to memory of 1960	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	29
PID 2988 wrote to memory of 1960	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	29
PID 2988 wrote to memory of 1960	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	29
PID 2988 wrote to memory of 1960	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	29
PID 2988 wrote to memory of 1960	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	29
PID 2988 wrote to memory of 1960	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	29
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 2988 wrote to memory of 1728	2988	d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe	30
PID 1728 wrote to memory of 1352	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1352	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1352	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1352	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1352	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1352	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1352	1728	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe
"C:\Users\Admin\AppData\Local\Temp\d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 200
    3⤵
    - Program crash
    PID:1352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1728-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1728-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1728-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1728-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1728-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1728-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1728-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1728-9-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1728-11-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads