25e8f920838a4eb6e629057269581ad50263648fe08454da33839ad43b9de23c

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe
Size

328KB
MD5

94d77950317c207c16b16fae18386e11
SHA1

7c7691f3cd41d068935b7da9daad29a2cb978ebf
SHA256

57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a
SHA512

aaf4eb2dcc850e3ac7d2714a93ba91544cb5bb1008caa01b1b9d758da4a0ab56348bf81e7e03f9ac82c85d0f6da77872ea990c9be4e334eb7fb1d6d2975b6b73
SSDEEP

6144:XkZrUxBda9xwyHlC4HTDUsExpMii7aIURc4rNItDYM2a0+brp0JDfW6:0ZraBdKweCewbMaIURc4RkDXKpfW6

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	2528	WerFault.exe	29

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2912	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	28
PID 1888 wrote to memory of 2912	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	28
PID 1888 wrote to memory of 2912	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	28
PID 1888 wrote to memory of 2912	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	28
PID 1888 wrote to memory of 2912	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	28
PID 1888 wrote to memory of 2912	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	28
PID 1888 wrote to memory of 2912	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	28
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 1888 wrote to memory of 2528	1888	57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe	29
PID 2528 wrote to memory of 2140	2528	AppLaunch.exe	30
PID 2528 wrote to memory of 2140	2528	AppLaunch.exe	30
PID 2528 wrote to memory of 2140	2528	AppLaunch.exe	30
PID 2528 wrote to memory of 2140	2528	AppLaunch.exe	30
PID 2528 wrote to memory of 2140	2528	AppLaunch.exe	30
PID 2528 wrote to memory of 2140	2528	AppLaunch.exe	30
PID 2528 wrote to memory of 2140	2528	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe
"C:\Users\Admin\AppData\Local\Temp\57083a094787ed8170c81a9cb93156f9bbcca04eee76b1ccbccd0d5ae1ae177a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 196
    3⤵
    - Program crash
    PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2528-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2528-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2528-9-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2528-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2528-3-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2528-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2528-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2528-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2528-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads