dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe
Size

1.1MB
MD5

692a59e85b4c932049ab55cb372a9509
SHA1

5a6ce3a44a42ca0c79d322cd4338685d8f8a1ccf
SHA256

dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa
SHA512

6cba914d55b498f0f190f7dba539d73b660b86326d4f9fb8a7834c771a41899909e7f4d2fed63efec3e8a6218a3da714c300d5c378e85847408c40741d90d692
SSDEEP

24576:bREW9gH1dNmfEqWZ6YeIPjvAwhXEoNqyXTo0o:bRs1dNmfbL1whXJrXTo0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1352 set thread context of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	1712	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1352 wrote to memory of 1712	1352	dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe	28
PID 1712 wrote to memory of 2712	1712	AppLaunch.exe	29
PID 1712 wrote to memory of 2712	1712	AppLaunch.exe	29
PID 1712 wrote to memory of 2712	1712	AppLaunch.exe	29
PID 1712 wrote to memory of 2712	1712	AppLaunch.exe	29
PID 1712 wrote to memory of 2712	1712	AppLaunch.exe	29
PID 1712 wrote to memory of 2712	1712	AppLaunch.exe	29
PID 1712 wrote to memory of 2712	1712	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe
"C:\Users\Admin\AppData\Local\Temp\dc094161dd0f8395e5363c61b3364191562edc470c785802d55d86f14bc40eaa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 196
    3⤵
    - Program crash
    PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1712-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1712-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads