be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe
Size

929KB
MD5

a208ce95e3318ffda061494fab5be220
SHA1

690d82f5394c7ba534d800db3f664e30cf71732e
SHA256

be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680
SHA512

8e7b006399076044a646b66096d40369af02da5f95ab0c9c3ef2d16de02645e5784e2d229c9fe4270153ae7b0e3f82652b7af37bf276dd86572ffc652abd5cb4
SSDEEP

24576:hiuBtZZYlcPj377vbZNoLZPOqPapcjX7ypwVIgip91xf6X6jo:MuBfZYwvboL4JptqIf9X6qU

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1136	2396	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 1900 wrote to memory of 2396	1900	be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe	29
PID 2396 wrote to memory of 1136	2396	AppLaunch.exe	30
PID 2396 wrote to memory of 1136	2396	AppLaunch.exe	30
PID 2396 wrote to memory of 1136	2396	AppLaunch.exe	30
PID 2396 wrote to memory of 1136	2396	AppLaunch.exe	30
PID 2396 wrote to memory of 1136	2396	AppLaunch.exe	30
PID 2396 wrote to memory of 1136	2396	AppLaunch.exe	30
PID 2396 wrote to memory of 1136	2396	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe
"C:\Users\Admin\AppData\Local\Temp\be23a8a29b8a7fcccaf8604d06192dcb3943b661a1670e434b36376118116680.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 200
    3⤵
    - Program crash
    PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-1-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2396-4-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2396-5-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2396-3-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2396-2-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2396-8-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2396-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2396-0-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2396-10-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2396-12-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads