bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe
Size

930KB
MD5

3460167c1d4aa82be63e7d58086d4dc3
SHA1

698a2c76dca22b0434f435fa686b8e16d3c09e07
SHA256

bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa
SHA512

79ab6533342e459d8d2c9602938541fdd9388dfa0fdd74c3d7ce2ac429a3a30da1b9cfc185312614e176ea8ec70540f729b92e651dce570baf0808f3f22441ac
SSDEEP

12288:d6//yfYb5BIQZVte2f8sD5ARNRDDyBPd0mWuh1eueMbQkXwSUqf7ZOqPMeIX9iDF:giuBtZsDM0fuuuw9qZFbANhTil+85

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2472 set thread context of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	2684	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2472 wrote to memory of 2684	2472	bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe	29
PID 2684 wrote to memory of 2696	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2696	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2696	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2696	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2696	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2696	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2696	2684	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe
"C:\Users\Admin\AppData\Local\Temp\bdd0c0769a20ac72ca52ebc4800706d55c5420e91c7150c2ed03c9093f2d7aaa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 200
    3⤵
    - Program crash
    PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-1-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2684-4-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2684-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-7-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2684-5-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2684-3-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2684-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2684-0-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2684-9-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2684-11-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads