914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea

Analysis

max time kernel
24s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 16:49

Target

914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
Size

25KB
MD5

8d42159d886956739fef83d8efc1b936
SHA1

967da45e9df6b11ac40880d60e7e60ffa71e906d
SHA256

914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea
SHA512

a79e786632677a68d24798c44df5feec3c8b6fe413811a0e822e306c6b520883b9c7c3f8f40f01feae28cbcbd2712d47be15103cd0dcd38364e2e8d182e1e77c
SSDEEP

768:EEF9hS8j5YIHuGkDgFJDyI/HXNR73zdL7cxn:EEF9/iIHkcFJy63zNox

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\amurpm.dll	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
File opened for modification	C:\Windows\SysWOW64\ntxeed.dll	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28
PID 1976 wrote to memory of 972	1976	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	28

C:\Users\Admin\AppData\Local\Temp\914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
"C:\Users\Admin\AppData\Local\Temp\914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe
  2⤵
  PID:972

memory/972-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/972-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/972-60-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/972-62-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1976-54-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1976-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download