dwmcore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dwmcore.dll
Size

1.3MB
MD5

a691d4b4b4167f56a717c421f9cf58c7
SHA1

2109e68e2e391e7f47f71ad7c2acc6da7e9e2d26
SHA256

ad92cb6fd606e6d1cd0aae565a6fbd5d134971f4a1b9ccb1b241f1c427a6fd95
SHA512

e3846984311e71172b53a5f20839e3b9f235acdb9cb10fb82d7ae99a3eb7a5ec2b8ef12d0f16e269174b947bb500e1beb55da70a7e39ed568b01f3f56a058c92
SSDEEP

24576:iczzs+84zyQidmWh8KoF+hS17O3Emm+iu7QNTLy4:pk+8a5wh8MwQ3ERdu7QNT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dwmcore.dll

Files

dwmcore.dll
.dll windows:6 windows x86 arch:x86

63cccdd3ce6765df49c0252b9eb5a2b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dwmcore.pdb

Imports

msvcrt

_except_handler4_common
_onexit
_lock
_ftol2
memcpy
_vsnwprintf
_amsg_exit
_CIsqrt
__dllonexit
_unlock
_wtof
memset
_finite
_isnan
memmove
_purecall
_ftol2_sse
modf
wcsstr
wcschr
wcstol
_XcptFilter
malloc
free
_initterm
_CIlog

ntdll

RtlInitializeBitMap
RtlSetBits
RtlFindClearBitsAndSet
RtlClearBits
WinSqmIsOptedIn
DbgPrompt
DbgPrintEx
RtlCaptureStackBackTrace
WinSqmAddToStream
NtQuerySystemInformation
NtQueryInformationProcess
RtlNtStatusToDosError
RtlInterlockedFlushSList
RtlIsGenericTableEmpty
RtlEnumerateGenericTableWithoutSplaying
RtlDeleteElementGenericTable
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlInitializeGenericTable
NtUnmapViewOfSection
NtMapViewOfSection
NtCreateSection

kernel32

LeaveCriticalSection
OpenEventW
ReleaseSemaphore
SetEvent
InterlockedIncrement
CreateEventW
WaitForSingleObject
DuplicateHandle
ResetEvent
WaitForMultipleObjects
GetCurrentProcessId
CreateWaitableTimerW
SetWaitableTimer
Sleep
MapViewOfFile
VirtualQuery
UnmapViewOfFile
EnterCriticalSection
LoadLibraryW
LocalFree
CreateThread
CreateFileMappingW
LocalAlloc
ReadFile
CancelIo
GetOverlappedResult
WriteFile
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
PulseEvent
InitializeSListHead
InterlockedPushEntrySList
InterlockedExchange
GetTickCount
OpenSemaphoreW
VirtualLock
GetProcessWorkingSetSize
SetProcessWorkingSetSize
DisableThreadLibraryCalls
OutputDebugStringW
GetCurrentThreadId
ExitProcess
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
HeapReAlloc
GetProcessHeap
DebugBreak
TerminateProcess
TerminateThread
GetCurrentThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CloseHandle
GetCurrentProcess
InterlockedDecrement
SetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryExA
InterlockedCompareExchange
FreeLibrary
GetLastError
GetProcAddress
DelayLoadFailureHook
GetSystemTimeAsFileTime
LockResource
LoadResource
FindResourceW
InterlockedExchangeAdd
QueryDepthSList
InterlockedFlushSList
SleepEx
CompareStringOrdinal
GetSystemInfo
GetVersionExW
GetModuleHandleW
HeapFree

user32

GetGuiResources
SystemParametersInfoW
GetMonitorInfoW
EnumDisplayMonitors
QueryDisplayConfig
GetDisplayConfigBufferSizes
EqualRect
IntersectRect
OffsetRect
CopyRect
ord1553
ClientToScreen
GetClientRect
InvalidateRect
PostMessageW
EnumDisplayDevicesW
IsWindow
SfmDxSetSwapChainStats
EnumDisplaySettingsW
SetLayeredWindowAttributes
SetRect
SfmDxReportPendingBindingsToDwm
SfmDxOpenSwapChain
SfmDxReleaseSwapChain
SfmDxSetSwapChainBindingStatus
SfmDxQuerySwapChainBindingStatus
IsRectEmpty

gdi32

ord1006
ord1007
ord1009
ord1003
CreateDCW
D3DKMTOpenAdapterFromHdc
D3DKMTGetPresentQueueEvent
DeleteDC
D3DKMTCloseAdapter
ord1000
D3DKMTGetPresentHistory
GetRegionData
RectInRegion
ord1004
GdiEntry13
GetDeviceCaps
CreateICW
ord1010
ord1005
ord1002
DeleteObject
GetRgnBox
CreateRectRgnIndirect
CreateRectRgn
SetRectRgn
CombineRgn
OffsetRgn
D3DKMTOpenAdapterFromGdiDisplayName
D3DKMTQueryAdapterInfo
ord1011

advapi32

EventWrite
EventEnabled
RegOpenKeyExW
EventRegister
EventUnregister
RegQueryValueExW
RegCloseKey

windowscodecs

WICCreateImagingFactory_Proxy

d3d10_1

D3D10CreateDevice1

dxgi

CreateDXGIFactory

Exports

Exports

MIL3DCalcBrushToIdealSampleSpace
MIL3DCalcProjected2DBounds
MILCreateFactory
MilChannel_AppendCommandData
MilChannel_BeginCommand
MilChannel_CommitChannel
MilChannel_EndCommand
MilChannel_FreeSyncCommandReplay
MilChannel_GetMarshalType
MilChannel_SendSyncCommand
MilChannel_SetNotificationWindow
MilChannel_SetReceiveBroadcastMessages
MilCommandTransport_AddRef
MilCommandTransport_Release
MilCompositionEngine_DeinitializePartitionManager
MilCompositionEngine_GetComposedEventId
MilCompositionEngine_GetFeedbackReader
MilCompositionEngine_InitializePartitionManager
MilCompositionEngine_UpdateSchedulerSettings
MilComposition_PeekNextMessage
MilComposition_SyncFlush
MilComposition_WaitForNextMessage
MilConnectionManager_NotifyHostEvent
MilConnection_ClearSfmEventOnPartition
MilConnection_CreateChannel
MilConnection_DestroyChannel
MilConnection_HandleSfmEventOnPartition
MilConnection_RecordUCE
MilCoreClientIsDwm
MilCrossThreadPacketTransport_Create
MilPlayer_Create
MilPlayer_Process
MilResource_CreateOrAddRefOnChannel
MilResource_DuplicateHandle
MilResource_ReleaseOnChannel
MilResource_SendCommand
MilResource_SendCommandBitmapSource
MilTransport_AddRef
MilTransport_Close
MilTransport_Create
MilTransport_CreateFromPacketTransport
MilTransport_CreateSurfaceManager
MilTransport_CreateTransportParameters
MilTransport_DisconnectTransport
MilTransport_InitializeConnectionManager
MilTransport_Open
MilTransport_PostPacket
MilTransport_Release
MilTransport_ShutDownConnectionManager
MilUtility_GetTileBrushMapping
MilVersionCheck
MilVisualTarget_AttachToHwnd
MilVisualTarget_DetachFromHwnd
SetMilPerfInstrumentationFlags

Sections

.text
Size: 669KB - Virtual size: 668KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 608KB - Virtual size: 608KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63cccdd3ce6765df49c0252b9eb5a2b2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

kernel32

user32

gdi32

advapi32

windowscodecs

d3d10_1

dxgi

Exports

Exports

Sections

.text Size: 669KB - Virtual size: 668KB

.data Size: 39KB - Virtual size: 39KB

.rsrc Size: 608KB - Virtual size: 608KB

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 669KB - Virtual size: 668KB

.data
Size: 39KB - Virtual size: 39KB

.rsrc
Size: 608KB - Virtual size: 608KB

.reloc
Size: 22KB - Virtual size: 21KB