a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe
Size

742KB
MD5

0ab0e98f6b669cda66e49012c22de8c2
SHA1

aca1b1c6e280e99f03e2085867e61dcbabb2ea62
SHA256

a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8
SHA512

4978389de9a25835fee4deb88734deed190f457d446f6ebe9e1f855ba1dc73b9f0db557c1bee7fc56407fc286fb57dbe06f56326100837cf019d92fc9ad672ea
SSDEEP

12288:wT//yfYb5BIQZVt6wJk4t5v6EjKyS6iLH5+Xi2EllCdiJyb3a0043lZE9ainp7lV:CiuBtZDt5v6CCkwkx3axKlZLS7lqyM9i

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	3052	WerFault.exe	31

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1732	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	28
PID 2220 wrote to memory of 1732	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	28
PID 2220 wrote to memory of 1732	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	28
PID 2220 wrote to memory of 1732	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	28
PID 2220 wrote to memory of 1732	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	28
PID 2220 wrote to memory of 1732	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	28
PID 2220 wrote to memory of 1732	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	28
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 2220 wrote to memory of 3052	2220	a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe	31
PID 3052 wrote to memory of 2588	3052	AppLaunch.exe	32
PID 3052 wrote to memory of 2588	3052	AppLaunch.exe	32
PID 3052 wrote to memory of 2588	3052	AppLaunch.exe	32
PID 3052 wrote to memory of 2588	3052	AppLaunch.exe	32
PID 3052 wrote to memory of 2588	3052	AppLaunch.exe	32
PID 3052 wrote to memory of 2588	3052	AppLaunch.exe	32
PID 3052 wrote to memory of 2588	3052	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe
"C:\Users\Admin\AppData\Local\Temp\a406803c889d607ec403a90a637ab86aec99a77f3d9bdb276b99c8822eb8c5e8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 200
    3⤵
    - Program crash
    PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-8-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3052-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-10-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/3052-12-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads