f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f

Analysis

max time kernel
110s
max time network
29s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14-10-2023 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe
Size

1014KB
MD5

e793f4d5680695ad632ef1414bbaefbe
SHA1

83dbfdf3a82c810eda811e7107a656ffff138eae
SHA256

f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f
SHA512

8c6bb9ce3c4dec52cd9d46ef51f63f2c5a5ce3d11649b01b967c05c98056c1ab05a05348dc988a8f64bd8731dc6ec0565e353421ecc96b6bc427b79e963858ed
SSDEEP

24576:xWrkfGnbsNujqFLYdDMaZYyMKI7GT0YMOBuZK0Hvsxky8ZHJwgYg:ukubsNujCYtKxSn1uZKKIOsg

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	2720	WerFault.exe	30

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2252 wrote to memory of 2720	2252	f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe	30
PID 2720 wrote to memory of 2652	2720	AppLaunch.exe	31
PID 2720 wrote to memory of 2652	2720	AppLaunch.exe	31
PID 2720 wrote to memory of 2652	2720	AppLaunch.exe	31
PID 2720 wrote to memory of 2652	2720	AppLaunch.exe	31
PID 2720 wrote to memory of 2652	2720	AppLaunch.exe	31
PID 2720 wrote to memory of 2652	2720	AppLaunch.exe	31
PID 2720 wrote to memory of 2652	2720	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe
"C:\Users\Admin\AppData\Local\Temp\f08136343f1dc930853ae6506b7b220bc97699314cc215cfbbcc3e85936db64f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 200
    3⤵
    - Program crash
    PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2720-1-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2720-3-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2720-2-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2720-0-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2720-4-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2720-5-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2720-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2720-7-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2720-9-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2720-11-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads