02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe
Size

742KB
MD5

dc0f33f640d4ff63c98d0301e872d196
SHA1

476cd471a39d90a37c1cdc1a857d7b4c63edaa5f
SHA256

02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0
SHA512

57755f049fd7ddd4deceb102efb0250611f2f01067c324fa8683395031352f2812e56a90949585222f80f84d1c220cbbddd7347f234a7e566eb8f30d4b8bb0d4
SSDEEP

12288:/B//yfYb5BIQZVtnLZXBGjDHjwyDEifNpblKPpyFwqKt0NY7R5JJbuEzBVF479:piuBtZTZxwPEi1ct0ONbj5y

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2684	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2292 wrote to memory of 2684	2292	02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe	29
PID 2684 wrote to memory of 2752	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2752	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2752	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2752	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2752	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2752	2684	AppLaunch.exe	30
PID 2684 wrote to memory of 2752	2684	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe
"C:\Users\Admin\AppData\Local\Temp\02f3472728c81bc22d0648476836d360c9e027e199399f262929128043f6bac0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 200
    3⤵
    - Program crash
    PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2684-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2684-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2684-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-8-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2684-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2684-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2684-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2684-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2684-10-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2684-12-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads