c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 14:09

Target

c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
Size

88KB
MD5

617f1b3170ed576536aeed53e3a75740
SHA1

10e8c6cb15d74d133a6a4aae1187d8c28f84e5a6
SHA256

c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb
SHA512

2c61dd5f7f9c7f18f09c1b9e0d13919cc9ffb87881ac2bcc8d49445971e275e15098b37019820288a81864cffb45205c7973251a9099bc6c46577cf2ca61326c
SSDEEP

1536:EcspT5gdmG187cNW7lGhgbzonnEZBwCQ7WwuzFpzBhp:bsEd47c2zoEZBw7W1vzbp

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\amurpm.dll	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
File opened for modification	C:\Windows\SysWOW64\ntxeed.dll	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 692 set thread context of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27
PID 692 wrote to memory of 1600	692	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	27

C:\Users\Admin\AppData\Local\Temp\c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
"C:\Users\Admin\AppData\Local\Temp\c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  PID:1600

memory/1600-56-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1600-57-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1600-59-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1600-63-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download