ecb7e5d542d0ee44a3b9f1a39a3ba620f407c67c2081ae133ae198c024451efb

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84cecce233745acdd9723c8bfa852090_exe32.exe
Size

447KB
MD5

84cecce233745acdd9723c8bfa852090
SHA1

e2b6f95fd04ee029b3dda2e40ff0906d2f32813c
SHA256

ecb7e5d542d0ee44a3b9f1a39a3ba620f407c67c2081ae133ae198c024451efb
SHA512

ab532e05e4e68c6d97cd3fa4c69e240009dbf52ccdbb9326f0a8ffaca87c4d112fd67496ea601b6607feb9d5f176f9f957b4312f72c6b9dd2b2897b1dc8fbe4a
SSDEEP

6144:9YaSI7LmaYkGSUm332GHECghdAOYmghM8ZeFCEZqfPF0j6bMulExKB5b10jvP9MB:War7SaPGI3GTqyttqF0j6lExKBzUMB

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2200	2412	WerFault.exe	10
2192	1548	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 1548	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	28
PID 2412 wrote to memory of 2200	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	29
PID 2412 wrote to memory of 2200	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	29
PID 2412 wrote to memory of 2200	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	29
PID 2412 wrote to memory of 2200	2412	84cecce233745acdd9723c8bfa852090_exe32.exe	29
PID 1548 wrote to memory of 2192	1548	AppLaunch.exe	30
PID 1548 wrote to memory of 2192	1548	AppLaunch.exe	30
PID 1548 wrote to memory of 2192	1548	AppLaunch.exe	30
PID 1548 wrote to memory of 2192	1548	AppLaunch.exe	30
PID 1548 wrote to memory of 2192	1548	AppLaunch.exe	30
PID 1548 wrote to memory of 2192	1548	AppLaunch.exe	30
PID 1548 wrote to memory of 2192	1548	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\84cecce233745acdd9723c8bfa852090_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\84cecce233745acdd9723c8bfa852090_exe32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 196
    3⤵
    - Program crash
    PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 136
  2⤵
  - Program crash
  PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1548-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1548-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads