fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df

Analysis

max time kernel
96s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 01:05

Target

fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
Size

24KB
MD5

a0a254c5e5d1fe4d4ee1c55f1bd2a220
SHA1

5dfb118ccc2ccf2a2b22c6f888662b848bb2e7a6
SHA256

fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df
SHA512

d6834f50b7db705d58b79827505aa024dd9306713eb2984789e7776076e3a422c28173b3f181a0e3f4f6d4d144a1d2c0426ec1d0cc87db5cfede2fb004a6d69d
SSDEEP

768:EaF9hSXpicEssQfjnHit7rdWeohvLt6KuKV7f:EaF9msQrnir0eo1EKuKZ

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ntxeed.dll	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
File opened for modification	C:\Windows\SysWOW64\amurpm.dll	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4708 set thread context of 636	4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3276	636	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe
4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 636	4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	82
PID 4708 wrote to memory of 636	4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	82
PID 4708 wrote to memory of 636	4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	82
PID 4708 wrote to memory of 636	4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	82
PID 4708 wrote to memory of 636	4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	82
PID 4708 wrote to memory of 636	4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	82
PID 4708 wrote to memory of 636	4708	fe005e640c6749b178b002e1fdf2f286845110cfe91146eca485d5b43a2099df.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 636 -ip 636
1⤵
PID:4168

memory/636-135-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/636-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4708-138-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download