2469e6632620289532f08e8aead0f39433c1a9ae98aa0440a9f70d93cfa7176c

Analysis

max time kernel
120s
max time network
140s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe
Size

929KB
MD5

cbcfab67801be2dead743d26a73b64eb
SHA1

c35452420444ed456e7a174c8ad1aa2d2138840a
SHA256

2469e6632620289532f08e8aead0f39433c1a9ae98aa0440a9f70d93cfa7176c
SHA512

12310016f45c7ce4c2e6271e962d4fb41769f4746cb9daf76748411bae0597504488123f36505a88878e6eb9cbdd1002d88a2b0287255bc1b5e79c8ea31d09dc
SSDEEP

24576:6iuBtZZ1sPM3CZZ1h0K3Ege+i6luNWo9u3Hw:RuBfZSL1hFEJ6luwdQ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2920 set thread context of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2076	WerFault.exe	30

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2000	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	29
PID 2920 wrote to memory of 2000	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	29
PID 2920 wrote to memory of 2000	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	29
PID 2920 wrote to memory of 2000	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	29
PID 2920 wrote to memory of 2000	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	29
PID 2920 wrote to memory of 2000	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	29
PID 2920 wrote to memory of 2000	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	29
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2920 wrote to memory of 2076	2920	SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe	30
PID 2076 wrote to memory of 2660	2076	AppLaunch.exe	31
PID 2076 wrote to memory of 2660	2076	AppLaunch.exe	31
PID 2076 wrote to memory of 2660	2076	AppLaunch.exe	31
PID 2076 wrote to memory of 2660	2076	AppLaunch.exe	31
PID 2076 wrote to memory of 2660	2076	AppLaunch.exe	31
PID 2076 wrote to memory of 2660	2076	AppLaunch.exe	31
PID 2076 wrote to memory of 2660	2076	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.61027.1808.383.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 200
    3⤵
    - Program crash
    PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2076-0-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2076-1-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2076-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2076-3-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2076-4-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2076-5-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2076-7-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2076-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2076-9-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2076-11-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads