62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe
Size

1.0MB
MD5

0196ccabdca5c7f15fd5b73fbc71110e
SHA1

a11a60fbff7c3586ba9d11f01203a6c5a9e79253
SHA256

62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a
SHA512

2a1161cfba2586f7ab6f0d5c8ac9e293af1343a5f42a6f667283f6c91e1224d55e76e911a412c5901a2d458b08399f6229544313bbc7b2943f109920e32d806d
SSDEEP

12288:VqEmGtWR2nmfCMLug57y5Dc+8dO+8ZKqNMDc7ulyoyCa52BOZYDTmel4:1NLnmfCMLug5GJ7FZKqN2a5WOGfv

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	3036	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 2296 wrote to memory of 3036	2296	62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe	28
PID 3036 wrote to memory of 2712	3036	AppLaunch.exe	29
PID 3036 wrote to memory of 2712	3036	AppLaunch.exe	29
PID 3036 wrote to memory of 2712	3036	AppLaunch.exe	29
PID 3036 wrote to memory of 2712	3036	AppLaunch.exe	29
PID 3036 wrote to memory of 2712	3036	AppLaunch.exe	29
PID 3036 wrote to memory of 2712	3036	AppLaunch.exe	29
PID 3036 wrote to memory of 2712	3036	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe
"C:\Users\Admin\AppData\Local\Temp\62d68d2f01c2a4ed724a1f1e1abcf4954cb5a8628fda42f2c01b483cf5d2e21a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 196
    3⤵
    - Program crash
    PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3036-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads