914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea

Analysis

max time kernel
92s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 16:49

Target

914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
Size

25KB
MD5

8d42159d886956739fef83d8efc1b936
SHA1

967da45e9df6b11ac40880d60e7e60ffa71e906d
SHA256

914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea
SHA512

a79e786632677a68d24798c44df5feec3c8b6fe413811a0e822e306c6b520883b9c7c3f8f40f01feae28cbcbd2712d47be15103cd0dcd38364e2e8d182e1e77c
SSDEEP

768:EEF9hS8j5YIHuGkDgFJDyI/HXNR73zdL7cxn:EEF9/iIHkcFJy63zNox

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ntxeed.dll	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
File opened for modification	C:\Windows\SysWOW64\amurpm.dll	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4308 set thread context of 5040	4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	81

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4688	5040	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe
4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 5040	4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	81
PID 4308 wrote to memory of 5040	4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	81
PID 4308 wrote to memory of 5040	4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	81
PID 4308 wrote to memory of 5040	4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	81
PID 4308 wrote to memory of 5040	4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	81
PID 4308 wrote to memory of 5040	4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	81
PID 4308 wrote to memory of 5040	4308	914d05cc91ee0761e9658d24d8404ce0ab51c9d2e34c2584af2efea630f07eea.exe	81

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5040 -ip 5040
1⤵
PID:4900

memory/4308-132-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4308-139-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/5040-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/5040-136-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download