Analysis
- max time kernel
72s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/11/2020, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe
- Size 479KB
- Sample201108-45m9lfffns
- SHA256 edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be
- MD5 4ddccd8fdc82ef5a6e0fec9e9bb7a4fc
- SHA1 843e7b6a79aabfa51c1140f02a994a4202804a67
- SHA512 4282ef46613cafd2e347fbba8089e78b9779f339cd943880ee2f82ef982b9b52282ffcdd05d06379d6960f8ee164487dad804cee5fc1c09323d02b4369e8d65f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
pid Process 984 edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe 984 edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe 984 edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe 984 edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe 984 edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe 984 edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ab76-346.dat js - Program crash 40 IoCs
pid pid_target Process procid_target 2416 984 WerFault.exe 67 3960 984 WerFault.exe 67 4080 984 WerFault.exe 67 2588 984 WerFault.exe 67 932 984 WerFault.exe 67 3932 984 WerFault.exe 67 2952 984 WerFault.exe 67 3844 984 WerFault.exe 67 1744 984 WerFault.exe 67 2808 984 WerFault.exe 67 3012 984 WerFault.exe 67 2652 984 WerFault.exe 67 3148 984 WerFault.exe 67 2028 984 WerFault.exe 67 1500 984 WerFault.exe 67 188 984 WerFault.exe 67 2060 984 WerFault.exe 67 3972 984 WerFault.exe 67 3808 984 WerFault.exe 67 3832 984 WerFault.exe 67 2280 984 WerFault.exe 67 2476 984 WerFault.exe 67 204 984 WerFault.exe 67 3504 984 WerFault.exe 67 4092 984 WerFault.exe 67 2456 984 WerFault.exe 67 2912 984 WerFault.exe 67 1004 984 WerFault.exe 67 2176 984 WerFault.exe 67 1864 984 WerFault.exe 67 3956 984 WerFault.exe 67 3916 984 WerFault.exe 67 808 984 WerFault.exe 67 1120 984 WerFault.exe 67 2668 984 WerFault.exe 67 2640 984 WerFault.exe 67 1856 984 WerFault.exe 67 2044 984 WerFault.exe 67 2448 984 WerFault.exe 67 3520 984 WerFault.exe 67 - Delays execution with timeout.exe 1 IoCs
pid Process 500 timeout.exe - Suspicious behavior: EnumeratesProcesses 563 IoCs
pid Process 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 3960 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 4080 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 3932 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 2952 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 1744 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 2808 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 3012 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 2652 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 3148 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 2028 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 1500 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3972 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3808 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2280 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 204 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 3504 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 4092 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2456 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 1864 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3956 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 3916 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 808 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 1120 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 2640 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2044 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 2448 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe 3520 WerFault.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeRestorePrivilege 2416 WerFault.exe Token: SeBackupPrivilege 2416 WerFault.exe Token: SeDebugPrivilege 2416 WerFault.exe Token: SeDebugPrivilege 3960 WerFault.exe Token: SeDebugPrivilege 4080 WerFault.exe Token: SeDebugPrivilege 2588 WerFault.exe Token: SeDebugPrivilege 932 WerFault.exe Token: SeDebugPrivilege 3932 WerFault.exe Token: SeDebugPrivilege 2952 WerFault.exe Token: SeDebugPrivilege 3844 WerFault.exe Token: SeDebugPrivilege 1744 WerFault.exe Token: SeDebugPrivilege 2808 WerFault.exe Token: SeDebugPrivilege 3012 WerFault.exe Token: SeDebugPrivilege 2652 WerFault.exe Token: SeDebugPrivilege 3148 WerFault.exe Token: SeDebugPrivilege 2028 WerFault.exe Token: SeDebugPrivilege 1500 WerFault.exe Token: SeDebugPrivilege 188 WerFault.exe Token: SeDebugPrivilege 2060 WerFault.exe Token: SeDebugPrivilege 3972 WerFault.exe Token: SeDebugPrivilege 3808 WerFault.exe Token: SeDebugPrivilege 3832 WerFault.exe Token: SeDebugPrivilege 2280 WerFault.exe Token: SeDebugPrivilege 2476 WerFault.exe Token: SeDebugPrivilege 204 WerFault.exe Token: SeDebugPrivilege 3504 WerFault.exe Token: SeDebugPrivilege 4092 WerFault.exe Token: SeDebugPrivilege 2456 WerFault.exe Token: SeDebugPrivilege 2912 WerFault.exe Token: SeDebugPrivilege 1004 WerFault.exe Token: SeDebugPrivilege 2176 WerFault.exe Token: SeDebugPrivilege 1864 WerFault.exe Token: SeDebugPrivilege 3956 WerFault.exe Token: SeDebugPrivilege 3916 WerFault.exe Token: SeDebugPrivilege 808 WerFault.exe Token: SeDebugPrivilege 1120 WerFault.exe Token: SeDebugPrivilege 2668 WerFault.exe Token: SeDebugPrivilege 2640 WerFault.exe Token: SeDebugPrivilege 1856 WerFault.exe Token: SeDebugPrivilege 2044 WerFault.exe Token: SeDebugPrivilege 2448 WerFault.exe Token: SeDebugPrivilege 3520 WerFault.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 984 wrote to memory of 1868 984 edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe 119 PID 984 wrote to memory of 1868 984 edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe 119 PID 984 wrote to memory of 1868 984 edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe 119 PID 1868 wrote to memory of 500 1868 cmd.exe 121 PID 1868 wrote to memory of 500 1868 cmd.exe 121 PID 1868 wrote to memory of 500 1868 cmd.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe"C:\Users\Admin\AppData\Local\Temp\edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 7322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 8442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 7042⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 8922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 11842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 12722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 13242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 12802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 13682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 8242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 13362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 14482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 13962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 14042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 14202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 10562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 11842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 13922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 14442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 8242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 13482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 14402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 16762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 16122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 18642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 19042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 19522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 19802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 15962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 18202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 15922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 17442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 19762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 18762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 17842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 17442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 17602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 18762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 17722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 20282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\edbc2fdaea1c75a2817bd067b44c19c1949954b1649e60061878bbfdbe01b6be.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:500
-
-