9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 12:45

Target

9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe
Size

840KB
MD5

7f8881646330cd8f2f3e15f5230ea381
SHA1

099ae87565cde8e1524e4d791de1918aed96e63b
SHA256

9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c
SHA512

6a87cceda9e30064b179250a8d65372468b0e00b925b5998659a12f85453e3e89cd9c8e7d013415927c2dcbbf6e150802b50c9580465944b1ac3b107bd02c001
SSDEEP

24576:6bMAVLCMMigEHNGVVFIyXmFuFnexCwwDlMB:6bzrMi9GlIyXuxCJlMB

Score

7^/10

Deletes itself 1 IoCs

pid	Process
660	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sev.exe	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe
File opened for modification	C:\Windows\SysWOW64\sev.exe	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 832 set thread context of 1312	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	28

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1312	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1312	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	28
PID 832 wrote to memory of 1312	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	28
PID 832 wrote to memory of 1312	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	28
PID 832 wrote to memory of 1312	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	28
PID 832 wrote to memory of 1312	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	28
PID 832 wrote to memory of 1312	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	28
PID 832 wrote to memory of 660	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	29
PID 832 wrote to memory of 660	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	29
PID 832 wrote to memory of 660	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	29
PID 832 wrote to memory of 660	832	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	29

C:\Users\Admin\AppData\Local\Temp\9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe
"C:\Users\Admin\AppData\Local\Temp\9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe ¨Á
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1312
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del /F "C:\Users\Admin\AppData\Local\Temp\9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe"
  2⤵
  - Deletes itself
  PID:660

memory/832-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/832-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/832-60-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/832-62-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1312-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1312-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download