5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/03/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe
Size

354KB
MD5

f72f6b9036a9273958dc09effeb0a10a
SHA1

88c6d3521a345c8fd688a7a35c25299cdf96c5cd
SHA256

5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc
SHA512

b5b72ff06efe22888ab2f8715b899477e73335fd04ae42a37a1e6da794a4e0b3d7ac6ad7f24e7dddaca91bc96484776bb1c49d5385096523e2cb380bed83f314
SSDEEP

6144:GraVXnTkSAH6vhHCb/qghjb3Bzeh0HNhlbnaUtMVSrZYeC15pdbGUJvcSvXj7gT:GcTkevhYhb3BTJbna8MjdbZnT

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1392 set thread context of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	2088	WerFault.exe	29

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 1392 wrote to memory of 2088	1392	5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe	29
PID 2088 wrote to memory of 2472	2088	RegAsm.exe	30
PID 2088 wrote to memory of 2472	2088	RegAsm.exe	30
PID 2088 wrote to memory of 2472	2088	RegAsm.exe	30
PID 2088 wrote to memory of 2472	2088	RegAsm.exe	30

C:\Users\Admin\AppData\Local\Temp\5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe
"C:\Users\Admin\AppData\Local\Temp\5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 256
    3⤵
    - Program crash
    PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-0-0x0000000000080000-0x00000000000DE000-memory.dmp

Filesize
376KB

Download
memory/1392-1-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/1392-6-0x00000000021E0000-0x00000000041E0000-memory.dmp

Filesize
32.0MB

Download
memory/1392-18-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/2088-4-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2088-7-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2088-8-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2088-10-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2088-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2088-9-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2088-14-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2088-17-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads