18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220

Analysis

max time kernel
117s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2022 23:44

Target

18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
Size

88KB
MD5

8404ba5c28927c7c1cd383e8ea903500
SHA1

53aea8823f57f404bd0f8b87f06bf66b700db3c3
SHA256

18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220
SHA512

a923998c14781562cd525e18e2c977c57a1a48db448c6f9408a06c212c65a2e6f3366aecee1c07012a11d0c9b2dd5c25c086f85206a1a3e2d055017aafce6668
SSDEEP

1536:EnXKjomTVLT8bshTDlUxmDz8nrzJpiei4jXjx5qqU:qRaRYbshpz8XJpc4jXN5pU

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\amurpm.dll	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
File opened for modification	C:\Windows\SysWOW64\ntxeed.dll	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 744 set thread context of 4336	744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5048	4336	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe
744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 4336	744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	82
PID 744 wrote to memory of 4336	744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	82
PID 744 wrote to memory of 4336	744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	82
PID 744 wrote to memory of 4336	744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	82
PID 744 wrote to memory of 4336	744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	82
PID 744 wrote to memory of 4336	744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	82
PID 744 wrote to memory of 4336	744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	82
PID 744 wrote to memory of 4336	744	18576b5560b4bd31e7be1f7b3082df52352ffd407d2a1a46e49909bf4ca6b220.exe	82

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4336 -ip 4336
1⤵
PID:2036

memory/4336-134-0x0000000000000000-mapping.dmp

Download
memory/4336-135-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4336-137-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download