616f5eba1eca93ac2d425b711ffd342cfce49448ac1a3b592f85cd1d45fe69de

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9558fca2b182f491a45249a3cfb547d4.exe
Size

167KB
MD5

9558fca2b182f491a45249a3cfb547d4
SHA1

fcc612bba8103f25c2f88cdada4ad813f3a11f93
SHA256

616f5eba1eca93ac2d425b711ffd342cfce49448ac1a3b592f85cd1d45fe69de
SHA512

95dc06fae5abb3e78414e715316e7ed3fd74ebbf619722ad00e084aa20f2a2f24b978c347338c156eba123b3d1946780acb9c8e61763da2fccbe79296a836810
SSDEEP

3072:In8YlCqh9MPEADHgctNADXcEG28Hi2pDJPFb3t0JJM53eXMknGjD03y:88YVrZHctNaXc528nXR3uJM3sMDa

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9558fca2b182f491a45249a3cfb547d4.exe

description pid process target process

PID 2428 set thread context of 2940 2428 9558fca2b182f491a45249a3cfb547d4.exe 9558fca2b182f491a45249a3cfb547d4.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2576 2940 WerFault.exe 9558fca2b182f491a45249a3cfb547d4.exe

description	pid	process	target process
PID 2428 set thread context of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe

pid	pid_target	process	target process
2576	2940	WerFault.exe	9558fca2b182f491a45249a3cfb547d4.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

9558fca2b182f491a45249a3cfb547d4.exe9558fca2b182f491a45249a3cfb547d4.exe

C:\Users\Admin\AppData\Local\Temp\9558fca2b182f491a45249a3cfb547d4.exe
"C:\Users\Admin\AppData\Local\Temp\9558fca2b182f491a45249a3cfb547d4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\9558fca2b182f491a45249a3cfb547d4.exe
  "C:\Users\Admin\AppData\Local\Temp\9558fca2b182f491a45249a3cfb547d4.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 148
    3⤵
    - Program crash
    PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-0-0x0000000074570000-0x0000000074B1B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-2-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2428-1-0x0000000074570000-0x0000000074B1B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-3-0x0000000074570000-0x0000000074B1B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2428-17-0x0000000074570000-0x0000000074B1B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2940-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2940-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2940-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2940-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2940-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2940-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2940-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2940-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

description	pid	process	target process
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2428 wrote to memory of 2940	2428	9558fca2b182f491a45249a3cfb547d4.exe	9558fca2b182f491a45249a3cfb547d4.exe
PID 2940 wrote to memory of 2576	2940	9558fca2b182f491a45249a3cfb547d4.exe	WerFault.exe
PID 2940 wrote to memory of 2576	2940	9558fca2b182f491a45249a3cfb547d4.exe	WerFault.exe
PID 2940 wrote to memory of 2576	2940	9558fca2b182f491a45249a3cfb547d4.exe	WerFault.exe
PID 2940 wrote to memory of 2576	2940	9558fca2b182f491a45249a3cfb547d4.exe	WerFault.exe