12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282

Analysis

max time kernel
240s
max time network
277s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe
Size

742KB
MD5

65da09996daf86723200abab2fe4ed5d
SHA1

624a24c6cf82ad8fb48494959b4a7656fcd1862c
SHA256

12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282
SHA512

859f7a41ad6d4a055d3d09f72d2028ab4dc8185fe7149ed04c9f4d1f4fae40b0f6ab169020e157c6199b8337ae09427f332565ba3b424db4541808d0a26f7813
SSDEEP

12288:JJ//yfYb5BIQZVt8keGlm/KJiYRVSpaLl5UubFlLT49T95FYy/n1K4SiFdA8pN9:riuBtZXeGgCNRVSo7FlLmYcn1KedPV

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	2732	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2640 wrote to memory of 2732	2640	SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe	28
PID 2732 wrote to memory of 2696	2732	AppLaunch.exe	29
PID 2732 wrote to memory of 2696	2732	AppLaunch.exe	29
PID 2732 wrote to memory of 2696	2732	AppLaunch.exe	29
PID 2732 wrote to memory of 2696	2732	AppLaunch.exe	29
PID 2732 wrote to memory of 2696	2732	AppLaunch.exe	29
PID 2732 wrote to memory of 2696	2732	AppLaunch.exe	29
PID 2732 wrote to memory of 2696	2732	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.390317.22246.31525.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 200
    3⤵
    - Program crash
    PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-0-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2732-2-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2732-4-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2732-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2732-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2732-3-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2732-7-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2732-1-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2732-9-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2732-11-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads