Cracked by dwmxs[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Cracked by dwmxs.exe
Size 54KB
Sample260808-rrj99aybre
SHA256 7b40847b9eb2fbdb03d5cdc8d1dcb13eba980daf114e7a09e395a4cf13eda8f7
MD5 647b1060ab655130c03a470fee7a8250
SHA1 9a7c5745cacc7c5bccabc339a2be455b66dbfaed
SHA512 16efb866233b61d4342dd270871d32f9629db2c5064c8160be077c06e28717326c77e29e1df9c308dfbfdc48f1064480f1361be7e86f032b25f8097655864906
SSDEEP 768:niJAZ4efXC+7kp3VyFgBgKR6wWIMWRCD8V0D7xHHnW:nikzBkplYK0LISgVc7RnW
TLSH
T1BE43192BCE16506FD35A9EB4D5560902DE33BC864BE1BACF93811CEA0F255D89F3B901
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Cracked by dwmxs.exe

File Explorer

Cracked by dwmxs.exe

.exe 54KB

Cracked by dwmxs.exe

IMPHASH 7d66f3be3436497b259bd69cdf5a287b
SHA256 7b40847b9eb2fbdb03d5cdc8d1dcb13eba980daf114e7a09e395a4cf13eda8f7
MD5 647b1060ab655130c03a470fee7a8250
SHA1 9a7c5745cacc7c5bccabc339a2be455b66dbfaed
SHA512 16efb866233b61d4342dd270871d32f9629db2c5064c8160be077c06e28717326c77e29e1df9c308dfbfdc48f1064480f1361be7e86f032b25f8097655864906
SSDEEP 768:niJAZ4efXC+7kp3VyFgBgKR6wWIMWRCD8V0D7xHHnW:nikzBkplYK0LISgVc7RnW
TLSH
T1BE43192BCE16506FD35A9EB4D5560902DE33BC864BE1BACF93811CEA0F255D89F3B901
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\0x21\Downloads\runtime-memory-patcher-2-main\x64\Release\RuntimePatcher.pdb

kernel32

GetStdHandle SetConsoleMode Thread32Next Thread32First SuspendThread ResumeThread OpenProcess CreateToolhelp32Snapshot GetConsoleMode GetLastError GetCurrentProcess Process32FirstW CloseHandle GetSystemInfo Module32FirstW VirtualProtectEx Module32NextW SetConsoleTitleW OpenThread VirtualQueryEx SetConsoleTextAttribute Process32NextW WriteProcessMemory Sleep GetCurrentThreadId SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Xlength_error@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __current_exception_context __current_exception __std_exception_copy __std_terminate memcpy memmove memset __C_specific_handler _CxxThrowException

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback exit terminate __p___argv _configure_narrow_argv _initialize_narrow_environment __p___argc _c_exit _initialize_onexit_table _beginthreadex _initterm _get_initial_narrow_environment _initterm_e _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _exit

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale