9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c

Analysis

max time kernel
191s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 12:45

Target

9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe
Size

840KB
MD5

7f8881646330cd8f2f3e15f5230ea381
SHA1

099ae87565cde8e1524e4d791de1918aed96e63b
SHA256

9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c
SHA512

6a87cceda9e30064b179250a8d65372468b0e00b925b5998659a12f85453e3e89cd9c8e7d013415927c2dcbbf6e150802b50c9580465944b1ac3b107bd02c001
SSDEEP

24576:6bMAVLCMMigEHNGVVFIyXmFuFnexCwwDlMB:6bzrMi9GlIyXuxCJlMB

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sev.exe	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe
File opened for modification	C:\Windows\SysWOW64\sev.exe	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1716 set thread context of 2188	1716	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	84

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4984	1716	WerFault.exe	80
4040	2188	WerFault.exe	84

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2188	1716	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	84
PID 1716 wrote to memory of 2188	1716	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	84
PID 1716 wrote to memory of 2188	1716	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	84
PID 1716 wrote to memory of 2188	1716	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	84
PID 1716 wrote to memory of 2188	1716	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	84
PID 1716 wrote to memory of 2168	1716	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	87
PID 1716 wrote to memory of 2168	1716	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	87
PID 1716 wrote to memory of 2168	1716	9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe	87

C:\Users\Admin\AppData\Local\Temp\9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe
"C:\Users\Admin\AppData\Local\Temp\9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 220
  2⤵
  - Program crash
  PID:4984
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe ¨Á
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 12
    3⤵
    - Program crash
    PID:4040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del /F "C:\Users\Admin\AppData\Local\Temp\9e783f8fef2908df452f3834d75f57839150067a92cbe96c3a1463b1875bca7c.exe"
  2⤵
  PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1716 -ip 1716
1⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2188 -ip 2188
1⤵
PID:4996

memory/1716-132-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1716-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/1716-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2188-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download