dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287

Analysis

max time kernel
189s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 22:14

Target

dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287.exe
Size

192KB
MD5

65d1f553f7bf69b9c5e41723416f1410
SHA1

0673faacbe7b5efdc8801df8832c577b7b491a1c
SHA256

dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287
SHA512

2cb28febc4f5f9a92187d3ea0abe8bbaa60fa7927698194ae51d87dca572a61eaa164836d419f76c49b9b1e49d404c9f77a403189195b20f5dbc6200a7ca8b78
SSDEEP

3072:E5CIwzT71gxge8PGjfW8CF//qOGHyvr4GFhUUL:E5Fwzmx38bhUUL

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
5088	dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wmimgr32.dl_	dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287.exe
File created	C:\Windows\SysWOW64\wmimgr32.dll	dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	5088	WerFault.exe	80

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5088	dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287.exe
5088	dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287.exe

C:\Users\Admin\AppData\Local\Temp\dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287.exe
"C:\Users\Admin\AppData\Local\Temp\dc05b0046a15245ebb2e1b033e4722dff81f5647bd73d54b78c249f3312a1287.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 512
  2⤵
  - Program crash
  PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5088 -ip 5088
1⤵
PID:4296

C:\Windows\SysWOW64\wmimgr32.dll

Filesize
23KB

MD5
9ebb3e4fc0c32524ba4098e214a06150

SHA1
41d0964a70edc0875ff9a8091b6911e18684e1ed

SHA256
f183002d0c6412dc694b580e0b33194766921415e77f713d46cb29dac6ae196d

SHA512
d7338292e03fd374fec772787e7561a6d6e9ca0b108cf4b6e9f79647bf0f64960ec78979e986f8bfa9874d907ecacca81183faacdd350e890c0dab02ca50298a

Download Submit
memory/5088-132-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5088-136-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download