bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2022 22:17

Target

bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe
Size

128KB
MD5

42e377a7151fc810378891e596e5848f
SHA1

69869d2ac9db40082ae9d3a755f820ede8f9d1e1
SHA256

bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b
SHA512

131b78872549bf1b065a1f504890253bebe8d444bc1b43fd096bd35f51d0e913931eecb55472162d68f8b56b57ffcfc264ce50150b0cd419f10370800849f82b
SSDEEP

1536:8uTBHjeYdkQ/it2QXMaa5JfqPJvXOcRllAbXomJnc8E7XwuVasxib4ygL:3vJatu5JfqvXl3OVnkXVVPic

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4024 set thread context of 1096	4024	bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe	84

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\c8vj.job	bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3860	4024	WerFault.exe	83

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 1096	4024	bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe	84
PID 4024 wrote to memory of 1096	4024	bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe	84
PID 4024 wrote to memory of 1096	4024	bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe	84
PID 4024 wrote to memory of 1096	4024	bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe	84
PID 4024 wrote to memory of 1096	4024	bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe	84

C:\Users\Admin\AppData\Local\Temp\bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe
"C:\Users\Admin\AppData\Local\Temp\bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Users\Admin\AppData\Local\Temp\bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe
  C:\Users\Admin\AppData\Local\Temp\bf414cdf2ccff83d86719d942cec8ef5cfd48dcfd834684fa6913e154bb1931b.exe
  2⤵
  - Drops file in Windows directory
  PID:1096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 292
  2⤵
  - Program crash
  PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4024 -ip 4024
1⤵
PID:1512

memory/1096-132-0x0000000000000000-mapping.dmp

Download
memory/1096-133-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1096-134-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1096-135-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1096-136-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download