39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe
Size

742KB
MD5

e3b011174462436d3a4532c7cdc273a8
SHA1

7273111902f0bed6595bd44de822024c1c6b390a
SHA256

39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b
SHA512

9ee5fc56ff3082a3d3146791f44086514572d6058b0fc2b31a246b3223de01958f7728ddcbfd937353a56e059065dd1007f4662492544c85b87a0d7cdfbaec6c
SSDEEP

12288:TF//yfYb5BIQZVtv+vm+Gz9CZoVfHfI8ersAmkE5wSK00OjccNFcEzg9:piuBtZuv+94oVf/XYQ1RFcE8

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2312	2268	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2584 wrote to memory of 2268	2584	39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe	29
PID 2268 wrote to memory of 2312	2268	AppLaunch.exe	30
PID 2268 wrote to memory of 2312	2268	AppLaunch.exe	30
PID 2268 wrote to memory of 2312	2268	AppLaunch.exe	30
PID 2268 wrote to memory of 2312	2268	AppLaunch.exe	30
PID 2268 wrote to memory of 2312	2268	AppLaunch.exe	30
PID 2268 wrote to memory of 2312	2268	AppLaunch.exe	30
PID 2268 wrote to memory of 2312	2268	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe
"C:\Users\Admin\AppData\Local\Temp\39badd45dcfcf740e008f8ff86547d54238f520ea75eb61229ef99b591be0d3b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 200
    3⤵
    - Program crash
    PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2268-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2268-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2268-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2268-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2268-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2268-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2268-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2268-9-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2268-11-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads