ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe
Size

741KB
MD5

c18668c0214ae3c707c0c23da80018d5
SHA1

5ca26749c7a266e1f45d7e009a96ba5e7a37abdc
SHA256

ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0
SHA512

f5da9dd17e8569befc476504b6c9779d7bc3b48cfcbc54ba7f65b56de99d79cb6aafb1b8579679bb397265b2eaca4381c401ae90a22b3ef8ab9464c064fe54af
SSDEEP

12288:z8//yfYb5BIQZVtA3F+FRRUiXI56cCFqOkPuYsDNuWWgwzya7NFoG0LE9:YiuBtZVXRULIFqOEuYM+gwzvroGz

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 320 set thread context of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	3052	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 320 wrote to memory of 3052	320	ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe	29
PID 3052 wrote to memory of 2644	3052	AppLaunch.exe	30
PID 3052 wrote to memory of 2644	3052	AppLaunch.exe	30
PID 3052 wrote to memory of 2644	3052	AppLaunch.exe	30
PID 3052 wrote to memory of 2644	3052	AppLaunch.exe	30
PID 3052 wrote to memory of 2644	3052	AppLaunch.exe	30
PID 3052 wrote to memory of 2644	3052	AppLaunch.exe	30
PID 3052 wrote to memory of 2644	3052	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe
"C:\Users\Admin\AppData\Local\Temp\ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 200
    3⤵
    - Program crash
    PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3052-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-9-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-11-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads