749c1576507a5a317908500bc23d0816cfe8c151f5694da5d35ac88afed9bd16

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79aa3380b9154758fca44948dfe80fba.exe
Size

184KB
MD5

79aa3380b9154758fca44948dfe80fba
SHA1

8d9f2068a11dc0f960f7d60494f5a341ab41aa74
SHA256

749c1576507a5a317908500bc23d0816cfe8c151f5694da5d35ac88afed9bd16
SHA512

9164420e07427c3b73c46d4c614a03f8f617a10c3d0be78a266d4f6570f24f375fc4f25051ff3e253d6d8d5325b25fb8c6b7044df0d3f6cb7d0da018587b648b
SSDEEP

3072:m/vg9DJ1tE/8nzvVC1ed2i8fzw+0jm2KEJ8uOvaT4+7ZuQnLWEnbaF9mwonOBAAQ:TlE/8zvc1hisNym128uOrWznLFent/ab

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 2208	2756	79aa3380b9154758fca44948dfe80fba.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2776	2756	WerFault.exe	15

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2208	2756	79aa3380b9154758fca44948dfe80fba.exe	28
PID 2756 wrote to memory of 2208	2756	79aa3380b9154758fca44948dfe80fba.exe	28
PID 2756 wrote to memory of 2208	2756	79aa3380b9154758fca44948dfe80fba.exe	28
PID 2756 wrote to memory of 2208	2756	79aa3380b9154758fca44948dfe80fba.exe	28
PID 2756 wrote to memory of 2208	2756	79aa3380b9154758fca44948dfe80fba.exe	28
PID 2756 wrote to memory of 2208	2756	79aa3380b9154758fca44948dfe80fba.exe	28
PID 2756 wrote to memory of 2776	2756	79aa3380b9154758fca44948dfe80fba.exe	29
PID 2756 wrote to memory of 2776	2756	79aa3380b9154758fca44948dfe80fba.exe	29
PID 2756 wrote to memory of 2776	2756	79aa3380b9154758fca44948dfe80fba.exe	29
PID 2756 wrote to memory of 2776	2756	79aa3380b9154758fca44948dfe80fba.exe	29

C:\Users\Admin\AppData\Local\Temp\79aa3380b9154758fca44948dfe80fba.exe
"C:\Users\Admin\AppData\Local\Temp\79aa3380b9154758fca44948dfe80fba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\79aa3380b9154758fca44948dfe80fba.exe
  C:\Users\Admin\AppData\Local\Temp\79aa3380b9154758fca44948dfe80fba.exe
  2⤵
  PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 128
  2⤵
  - Program crash
  PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-19-0x0000000000020000-0x0000000000032000-memory.dmp

Filesize
72KB

Download
memory/2208-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-17-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2208-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2756-2-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2756-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2756-8-0x0000000001D60000-0x0000000001D70000-memory.dmp

Filesize
64KB

Download
memory/2756-0-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2756-12-0x0000000077CE1000-0x0000000077CE2000-memory.dmp

Filesize
4KB

Download
memory/2756-9-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2756-1-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2756-3-0x0000000000270000-0x00000000002A9000-memory.dmp

Filesize
228KB

Download
memory/2756-6-0x0000000077CDF000-0x0000000077CE0000-memory.dmp

Filesize
4KB

Download
memory/2756-7-0x00000000775A0000-0x00000000776B0000-memory.dmp

Filesize
1.1MB

Download
memory/2756-5-0x0000000077CE0000-0x0000000077CE1000-memory.dmp

Filesize
4KB

Download
memory/2756-20-0x0000000010000000-0x000000001002D000-memory.dmp

Filesize
180KB

Download
memory/2756-21-0x0000000000270000-0x00000000002A9000-memory.dmp

Filesize
228KB

Download
memory/2756-23-0x0000000001DF0000-0x0000000001E00000-memory.dmp

Filesize
64KB

Download
memory/2756-22-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2756-24-0x0000000001DF0000-0x0000000001E00000-memory.dmp

Filesize
64KB

Download
memory/2756-26-0x0000000001D60000-0x0000000001D70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads