c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 14:09

Target

c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
Size

88KB
MD5

617f1b3170ed576536aeed53e3a75740
SHA1

10e8c6cb15d74d133a6a4aae1187d8c28f84e5a6
SHA256

c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb
SHA512

2c61dd5f7f9c7f18f09c1b9e0d13919cc9ffb87881ac2bcc8d49445971e275e15098b37019820288a81864cffb45205c7973251a9099bc6c46577cf2ca61326c
SSDEEP

1536:EcspT5gdmG187cNW7lGhgbzonnEZBwCQ7WwuzFpzBhp:bsEd47c2zoEZBw7W1vzbp

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\amurpm.dll	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
File opened for modification	C:\Windows\SysWOW64\ntxeed.dll	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3268 set thread context of 3112	3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
632	3112	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe
3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3112	3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	83
PID 3268 wrote to memory of 3112	3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	83
PID 3268 wrote to memory of 3112	3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	83
PID 3268 wrote to memory of 3112	3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	83
PID 3268 wrote to memory of 3112	3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	83
PID 3268 wrote to memory of 3112	3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	83
PID 3268 wrote to memory of 3112	3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	83
PID 3268 wrote to memory of 3112	3268	c0e78a8aca37ea05aa9ba272a6a535729ddaecedae4d02aa72af5531207478fb.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3112 -ip 3112
1⤵
PID:388

memory/3112-135-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3112-137-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download