dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b

Analysis

max time kernel
102s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:05

Target

dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe
Size

88KB
MD5

2c7196996f0b69b356bb5f30669dc9c8
SHA1

b10f59e21147707a7c8bf29c4688a7d4e20343c4
SHA256

dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b
SHA512

b830075140f1ca496b39ee24517c6fed71d41dd133f77983f84496f92bf2cc51011a2e643e4518b1463fea312f960bbbf62036ee41afed19c6018106224244ea
SSDEEP

1536:EcdG4FYebXF7lyWlKz8nCChjqm3OHgLDCtj7h:FdxbXez8ZhjAHgqt3h

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\amurpm.dll	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe
File opened for modification	C:\Windows\SysWOW64\ntxeed.dll	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3096 set thread context of 3004	3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4376	3004	WerFault.exe	80

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe
3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe
3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe
3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe
3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe
3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 3004	3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe	80
PID 3096 wrote to memory of 3004	3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe	80
PID 3096 wrote to memory of 3004	3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe	80
PID 3096 wrote to memory of 3004	3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe	80
PID 3096 wrote to memory of 3004	3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe	80
PID 3096 wrote to memory of 3004	3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe	80
PID 3096 wrote to memory of 3004	3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe	80
PID 3096 wrote to memory of 3004	3096	dfc06c52aaa077bf243bf70b7e2fa6fe75f10302f44e52a686d010f74b48de9b.exe	80

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3004 -ip 3004
1⤵
PID:1500

memory/3004-135-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3004-137-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download