dwm[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dwm.exe
Size

116KB
MD5

189883d21c175dbf922ebbdfe81d3274
SHA1

4e1fae1286c02850a26a4bce475526ff411c2a24
SHA256

5ed731af7c41532c0a3ed3842896179207e366d239022d6ba85c060e837310c0
SHA512

bee4b25e58d849c4964f35af67ba33f156b88e65ec8b1b1312c40f97e11db8ab15d4b6b531fe609d61ef770f38470b7c1f770728fde505c374b61b24a094bbc7
SSDEEP

3072:590GvPShoyNZsXR8wnepQb4rTDvbXYaW:590Gih5NZsXWwb4zvbXYa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dwm.exe

Files

dwm.exe
.exe windows:10 windows x64 arch:x64

3320624db644525d7a5834de633d34f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_invoke_watson

api-ms-win-crt-private-l1-1-0

_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
memmove
_o__wcsicmp
_o__wtof
_o_exit
_o_free
_o_malloc
_o_terminate
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o__configure_wide_argv
_o__configthreadlocale
_o___p__commode
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o__crt_atexit
_o___std_exception_destroy
_o___std_exception_copy
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
wcscmp

api-ms-win-core-windowserrorreporting-l1-1-0

WerSetFlags

api-ms-win-core-windowserrorreporting-l1-1-3

WerSetMaxProcessHoldMilliseconds

api-ms-win-core-windowserrorreporting-l1-1-1

WerRegisterCustomMetadata
WerUnregisterCustomMetadata

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW
DeregisterEventSource
ReportEventW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
GetModuleFileNameA
GetModuleHandleExA
GetModuleHandleW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateSemaphoreExW
AcquireSRWLockShared
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
ReleaseSemaphore
CreateMutexExW
TryAcquireSRWLockExclusive
CreateEventW
DeleteCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
InitializeCriticalSectionEx
ReleaseMutex
ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapSetInformation
HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter
GetLastError
SetLastError
SetErrorMode

api-ms-win-core-processthreads-l1-1-0

ProcessIdToSessionId
GetCurrentThread
ExitProcess
GetCurrentThreadId
GetStartupInfoW
OpenProcessToken
GetCurrentProcessId
GetCurrentProcess
TerminateThread
TerminateProcess
SetPriorityClass

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
CheckTokenMembership

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegGetValueW
RegSetValueExW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
RtlCaptureStackBackTrace

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-version-l1-1-0

VerQueryValueW

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-composition-redirection-l1-1-0

DwmInitializePort

api-ms-win-composition-windowmanager-l1-1-0

ord101

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTCheckVidPnExclusiveOwnership
D3DKMTSetProcessSchedulingPriorityClass
D3DKMTEscape

api-ms-win-dx-d3dkmt-l1-1-1

D3DKMTOpenAdapterFromLuid

api-ms-win-rtcore-ntuser-private-l1-1-0

RegisterSessionPort

api-ms-win-rtcore-ntuser-private-l1-1-2

DwmKernelStartup

api-ms-win-rtcore-ntuser-window-l1-1-0

PostMessageW
DestroyWindow
DispatchMessageW
PostQuitMessage
DefWindowProcW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassExW

win32u

NtDesktopCaptureBits

ntdll

NtAlpcSendWaitReceivePort
RtlNtStatusToDosError
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlPublishWnfStateData
NtSetInformationProcess
RtlFreeSid
RtlAllocateAndInitializeSid
EtwEventRegister
EtwEventWriteTransfer
RtlGetDeviceFamilyInfoEnum
NtQueryInformationProcess
NtQuerySystemInformation
DbgPrintEx
DbgPrompt

dxgi

DXGIDeclareAdapterRemovalSupport

coremessaging

CoreUICreate

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

dwmcore

MilCompositionEngine_Initialize

msvcp_win

_Query_perf_counter
?_Xlength_error@std@@YAXPEBD@Z
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
_Query_perf_frequency

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-errorhandling-l1-1-3

TerminateProcessOnMemoryExhaustion

api-ms-win-core-errorhandling-l1-1-2

RaiseFailFastException

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3320624db644525d7a5834de633d34f6

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-3

api-ms-win-core-windowserrorreporting-l1-1-1

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-version-l1-1-0

rpcrt4

api-ms-win-core-memory-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-composition-redirection-l1-1-0

api-ms-win-composition-windowmanager-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-0

api-ms-win-dx-d3dkmt-l1-1-1

api-ms-win-rtcore-ntuser-private-l1-1-0

api-ms-win-rtcore-ntuser-private-l1-1-2

api-ms-win-rtcore-ntuser-window-l1-1-0

win32u

ntdll

dxgi

coremessaging

api-ms-win-core-apiquery-l1-1-0

dwmcore

msvcp_win

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-errorhandling-l1-1-2

Sections

.text Size: 56KB - Virtual size: 53KB

.rdata Size: 28KB - Virtual size: 25KB

.data Size: 4KB - Virtual size: 17KB

.pdata Size: 8KB - Virtual size: 4KB

.didat Size: 4KB - Virtual size: 176B

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 324B

.text
Size: 56KB - Virtual size: 53KB

.rdata
Size: 28KB - Virtual size: 25KB

.data
Size: 4KB - Virtual size: 17KB

.pdata
Size: 8KB - Virtual size: 4KB

.didat
Size: 4KB - Virtual size: 176B

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 324B