6f47ce8d481819b0aa5bbf8dd18e7901ec39a7e3304493ce8a60ffbefb9a9b8d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe
Size

1.0MB
MD5

6749e5d28d5a6967a4b90d10a6af05c0
SHA1

2e4db576c1a56c3cd99310d5dbc32a5b013b91c5
SHA256

8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91
SHA512

1ca7583e887f235f3180c6e161c84e02b7549eb655bb6a1d0b0e5efc112e9f9d8f7d33faaa8c51798e41ca0f6ce64c045a4ecabbda2dd0ac3b9784463f9edd9f
SSDEEP

12288:bqEmJ0wR2nmfCMLug57y5Dc+8dO+8ZKqNMDc7ulyoy+dPdADPj3L:DRRnmfCMLug5GJ7FZKqNMPdADPj

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2356 set thread context of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	1988	WerFault.exe	27

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 2356 wrote to memory of 1988	2356	8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe	27
PID 1988 wrote to memory of 2552	1988	AppLaunch.exe	28
PID 1988 wrote to memory of 2552	1988	AppLaunch.exe	28
PID 1988 wrote to memory of 2552	1988	AppLaunch.exe	28
PID 1988 wrote to memory of 2552	1988	AppLaunch.exe	28
PID 1988 wrote to memory of 2552	1988	AppLaunch.exe	28
PID 1988 wrote to memory of 2552	1988	AppLaunch.exe	28
PID 1988 wrote to memory of 2552	1988	AppLaunch.exe	28

C:\Users\Admin\AppData\Local\Temp\8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe
"C:\Users\Admin\AppData\Local\Temp\8b09b3d3450af74342ed069e5408a5a19358fba768467d23d2d8979635a76e91.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 196
    3⤵
    - Program crash
    PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1988-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1988-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads