35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe
Size

742KB
MD5

54c5c31aeedfec77556026ade8842c8a
SHA1

ad6aacf4aecfacb6b62d6889e17cee3b4e85af4f
SHA256

35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122
SHA512

68607873f0104e2eaa9c7b2f3aad0247b59f5cbe1243c3491baf29843ffabc61bd86e1e40db65636ee3391f130e40836c5d605c0a3b442d7930dc7a58514223c
SSDEEP

12288:4r//yfYb5BIQZVtl+PYLaVsXzcYKk8KimW+lU0NypfhHHzhL43nZI9:2iuBtZYvVsXXKnKiJ+lUWyZhnzK3n2

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3016 set thread context of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	2608	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 3016 wrote to memory of 2608	3016	35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe	29
PID 2608 wrote to memory of 2588	2608	AppLaunch.exe	30
PID 2608 wrote to memory of 2588	2608	AppLaunch.exe	30
PID 2608 wrote to memory of 2588	2608	AppLaunch.exe	30
PID 2608 wrote to memory of 2588	2608	AppLaunch.exe	30
PID 2608 wrote to memory of 2588	2608	AppLaunch.exe	30
PID 2608 wrote to memory of 2588	2608	AppLaunch.exe	30
PID 2608 wrote to memory of 2588	2608	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe
"C:\Users\Admin\AppData\Local\Temp\35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 200
    3⤵
    - Program crash
    PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2608-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2608-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-9-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2608-11-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads