fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df

Analysis

max time kernel
15s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 01:05

Target

fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
Size

24KB
MD5

a0a254c5e5d1fe4d4ee1c55f1bd2a220
SHA1

5dfb118ccc2ccf2a2b22c6f888662b848bb2e7a6
SHA256

fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df
SHA512

d6834f50b7db705d58b79827505aa024dd9306713eb2984789e7776076e3a422c28173b3f181a0e3f4f6d4d144a1d2c0426ec1d0cc87db5cfede2fb004a6d69d
SSDEEP

768:EaF9hSXpicEssQfjnHit7rdWeohvLt6KuKV7f:EaF9msQrnir0eo1EKuKZ

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\amurpm.dll	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
File opened for modification	C:\Windows\SysWOW64\ntxeed.dll	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28
PID 1852 wrote to memory of 884	1852	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	28

C:\Users\Admin\AppData\Local\Temp\fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
"C:\Users\Admin\AppData\Local\Temp\fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  PID:884

memory/884-56-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/884-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/884-59-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/884-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1852-64-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download