c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf

Analysis

max time kernel
124s
max time network
42s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe
Size

1.3MB
MD5

ee90460d280389f642449bdc00e6ffbd
SHA1

2f7c4dbaada1e1012065f88ace2b0b55901b259a
SHA256

c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf
SHA512

d5cc9a06ba40e8955ac066ff63732e424c9a1a4b2dc96bfb5bc367bf7f42be2afb01691a773dd8b39279390f97bf40e12942355efee7b98f28918e62ac78dc08
SSDEEP

24576:/iuBtZ33dRkFCREwUF1OtBO78PKN2KEopMm51zsT5wgSuXSuH:6uBf33dRkFCREHyoIPK0wAT5wgRXj

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2520	2704	WerFault.exe	30

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2628 wrote to memory of 2704	2628	c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe	30
PID 2704 wrote to memory of 2520	2704	AppLaunch.exe	31
PID 2704 wrote to memory of 2520	2704	AppLaunch.exe	31
PID 2704 wrote to memory of 2520	2704	AppLaunch.exe	31
PID 2704 wrote to memory of 2520	2704	AppLaunch.exe	31
PID 2704 wrote to memory of 2520	2704	AppLaunch.exe	31
PID 2704 wrote to memory of 2520	2704	AppLaunch.exe	31
PID 2704 wrote to memory of 2520	2704	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe
"C:\Users\Admin\AppData\Local\Temp\c8103ad4f1227c8b9d7f824e2ef54dcbb03631a2ea993ee2501c226cdab07ebf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 200
    3⤵
    - Program crash
    PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-0-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2704-1-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2704-2-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2704-3-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2704-4-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2704-5-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2704-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2704-7-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2704-9-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2704-11-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads