Windows Analysis Report
createdump.exe

Overview

General Information

Sample name: createdump.exe
Analysis ID: 1427814
MD5: 688a16f9e8568486cf917be2edcddc09
SHA1: ce3ad3daf096e89487493b68d14d4e4d77aacfc6
SHA256: f5785f7d354173ef61b1264538433c34b02459227337ef6aff863787baf5fa6c
Infos:

Detection

Score: 3
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)
Found large amount of non-executed APIs
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info

Classification

Source: createdump.exe Static PE information: certificate valid
Source: createdump.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb source: createdump.exe
Source: Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb;;;GCTL source: createdump.exe
Sample file is different than original file name gathered from version info
Source: createdump.exe Binary or memory string: OriginalFilename vs createdump.exe
Source: createdump.exe, 00000000.00000002.1649988427.00007FF68D62D000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameFX_VER_INTERNALNAME_STR@ vs createdump.exe
Source: createdump.exe Binary or memory string: OriginalFilenameFX_VER_INTERNALNAME_STR@ vs createdump.exe
Source: classification engine Classification label: clean3.winEXE@2/1@0/0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: createdump.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\createdump.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\createdump.exe "C:\Users\user\Desktop\createdump.exe"
Source: C:\Users\user\Desktop\createdump.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\createdump.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\createdump.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Users\user\Desktop\createdump.exe Section loaded: dbgcore.dll Jump to behavior
Source: C:\Users\user\Desktop\createdump.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: createdump.exe Static PE information: certificate valid
Source: initial sample Static PE information: Valid certificate with Microsoft Issuer
Source: createdump.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: createdump.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: createdump.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: createdump.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: createdump.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: createdump.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: createdump.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: createdump.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: createdump.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb source: createdump.exe
Source: Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb;;;GCTL source: createdump.exe
Source: createdump.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: createdump.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: createdump.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: createdump.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: createdump.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
PE file contains sections with non-standard names
Source: createdump.exe Static PE information: section name: _RDATA
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\createdump.exe API coverage: 8.2 %
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\createdump.exe Code function: 0_2_00007FF68D622ECC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF68D622ECC
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\createdump.exe Code function: 0_2_00007FF68D623074 SetUnhandledExceptionFilter, 0_2_00007FF68D623074
Source: C:\Users\user\Desktop\createdump.exe Code function: 0_2_00007FF68D622ECC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00007FF68D622ECC
Source: C:\Users\user\Desktop\createdump.exe Code function: 0_2_00007FF68D622984 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00007FF68D622984
Source: C:\Users\user\Desktop\createdump.exe Code function: 0_2_00007FF68D622DA0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF68D622DA0

No Screenshots

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1427814 Sample: createdump.exe Startdate: 18/04/2024 Architecture: WINDOWS Score: 3 5 createdump.exe 1 2->5         started        process3 7 conhost.exe 5->7         started       
⊘No contacted IP infos