391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe
Size

363KB
MD5

e720940033d0a875c83f019ee7418487
SHA1

872728a8b723b37735a5eaeb35516f747b6b4f17
SHA256

391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c
SHA512

bb6aebe4e825c72460ff6cc6b6ac17a23033e0faff0ff7c8d2d0a6781459ef5044ff482410863b46dc5f683512e602f7a04a17528ee9d8292f24fddabbb31cdf
SSDEEP

6144:wORjQKzqpAnLBZzxKnCoPoMiqbk9MKbzZJR7oM79fI7L+ZQe0cczk:7YSnFLKnCoXiqbkusj9jC+QPccY

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	2100	WerFault.exe	30

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2508	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	28
PID 2196 wrote to memory of 2508	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	28
PID 2196 wrote to memory of 2508	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	28
PID 2196 wrote to memory of 2508	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	28
PID 2196 wrote to memory of 2508	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	28
PID 2196 wrote to memory of 2508	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	28
PID 2196 wrote to memory of 2508	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	28
PID 2196 wrote to memory of 3044	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	29
PID 2196 wrote to memory of 3044	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	29
PID 2196 wrote to memory of 3044	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	29
PID 2196 wrote to memory of 3044	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	29
PID 2196 wrote to memory of 3044	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	29
PID 2196 wrote to memory of 3044	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	29
PID 2196 wrote to memory of 3044	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	29
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2196 wrote to memory of 2100	2196	391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe	30
PID 2100 wrote to memory of 2548	2100	RegAsm.exe	31
PID 2100 wrote to memory of 2548	2100	RegAsm.exe	31
PID 2100 wrote to memory of 2548	2100	RegAsm.exe	31
PID 2100 wrote to memory of 2548	2100	RegAsm.exe	31

C:\Users\Admin\AppData\Local\Temp\391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe
"C:\Users\Admin\AppData\Local\Temp\391da8243c814cb635942aae0339f210f3520fab3360220d3c68cde1438bd83c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2508
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 256
    3⤵
    - Program crash
    PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-9-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2100-5-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2100-6-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2100-7-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2100-11-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2100-13-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2100-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2100-16-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2100-20-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2196-1-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2196-4-0x00000000022A0000-0x00000000042A0000-memory.dmp

Filesize
32.0MB

Download
memory/2196-0-0x0000000000E30000-0x0000000000E92000-memory.dmp

Filesize
392KB

Download
memory/2196-19-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads