12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe
Size

742KB
MD5

65da09996daf86723200abab2fe4ed5d
SHA1

624a24c6cf82ad8fb48494959b4a7656fcd1862c
SHA256

12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282
SHA512

859f7a41ad6d4a055d3d09f72d2028ab4dc8185fe7149ed04c9f4d1f4fae40b0f6ab169020e157c6199b8337ae09427f332565ba3b424db4541808d0a26f7813
SSDEEP

12288:JJ//yfYb5BIQZVt8keGlm/KJiYRVSpaLl5UubFlLT49T95FYy/n1K4SiFdA8pN9:riuBtZXeGgCNRVSo7FlLmYcn1KedPV

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	2408	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 1888 wrote to memory of 2408	1888	12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe	29
PID 2408 wrote to memory of 2016	2408	AppLaunch.exe	30
PID 2408 wrote to memory of 2016	2408	AppLaunch.exe	30
PID 2408 wrote to memory of 2016	2408	AppLaunch.exe	30
PID 2408 wrote to memory of 2016	2408	AppLaunch.exe	30
PID 2408 wrote to memory of 2016	2408	AppLaunch.exe	30
PID 2408 wrote to memory of 2016	2408	AppLaunch.exe	30
PID 2408 wrote to memory of 2016	2408	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe
"C:\Users\Admin\AppData\Local\Temp\12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 200
    3⤵
    - Program crash
    PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-9-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-11-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2408-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2408-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads