Analysis
- max time kernel
151s - max time network
137s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 11:43
Static task
static1
Behavioral task
behavioral1
Sample
2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe
- Size 487KB
- Sample201111-c4es5l2pmn
- SHA256 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4
- MD5 bad103e7901dab550613a7d89bf10c4f
- SHA1 4f34aebf03c1840ef604064deefc02a030501134
- SHA512 b2be0cd2cb292b532adecadc5ea1e873ba8f44e3f64acc599038872cde6a070b8d18866e774c6e8dae3b6661a41e87facd58a3943d31395032868ef23638e715
- MD5 SHA1 SHA512
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000100000001abb8-638.dat js - Program crash 42 IoCs
pid pid_target Process procid_target 1696 636 WerFault.exe 67 568 636 WerFault.exe 67 2316 636 WerFault.exe 67 3712 636 WerFault.exe 67 192 636 WerFault.exe 67 2040 636 WerFault.exe 67 3644 636 WerFault.exe 67 2308 636 WerFault.exe 67 2440 636 WerFault.exe 67 4044 636 WerFault.exe 67 1520 636 WerFault.exe 67 2132 636 WerFault.exe 67 3872 636 WerFault.exe 67 2324 636 WerFault.exe 67 4032 636 WerFault.exe 67 3664 636 WerFault.exe 67 3556 636 WerFault.exe 67 2832 636 WerFault.exe 67 3608 636 WerFault.exe 67 4012 636 WerFault.exe 67 2220 636 WerFault.exe 67 416 636 WerFault.exe 67 4016 636 WerFault.exe 67 2252 636 WerFault.exe 67 3540 636 WerFault.exe 67 796 636 WerFault.exe 67 4000 636 WerFault.exe 67 3996 636 WerFault.exe 67 184 636 WerFault.exe 67 676 636 WerFault.exe 67 612 636 WerFault.exe 67 2388 636 WerFault.exe 67 2112 636 WerFault.exe 67 3832 636 WerFault.exe 67 3068 636 WerFault.exe 67 848 636 WerFault.exe 67 3752 636 WerFault.exe 67 1040 636 WerFault.exe 67 2156 636 WerFault.exe 67 3028 636 WerFault.exe 67 4008 636 WerFault.exe 67 4024 636 WerFault.exe 67 - Delays execution with timeout.exe 1 IoCs
pid Process 1748 timeout.exe - Suspicious behavior: EnumeratesProcesses 588 IoCs
pid Process 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 1696 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 568 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 2316 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 3712 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 2040 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 3644 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 2440 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 2132 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 3872 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 4032 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3664 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 3556 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 2832 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 3608 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 4012 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 2252 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 3540 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 4000 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 3996 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 184 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 676 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 612 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2388 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 2112 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 3068 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 848 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 3752 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 1040 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 2156 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 3028 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4008 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe 4024 WerFault.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeRestorePrivilege 1696 WerFault.exe Token: SeBackupPrivilege 1696 WerFault.exe Token: SeDebugPrivilege 1696 WerFault.exe Token: SeDebugPrivilege 568 WerFault.exe Token: SeDebugPrivilege 2316 WerFault.exe Token: SeDebugPrivilege 3712 WerFault.exe Token: SeDebugPrivilege 192 WerFault.exe Token: SeDebugPrivilege 2040 WerFault.exe Token: SeDebugPrivilege 3644 WerFault.exe Token: SeDebugPrivilege 2308 WerFault.exe Token: SeDebugPrivilege 2440 WerFault.exe Token: SeDebugPrivilege 4044 WerFault.exe Token: SeDebugPrivilege 1520 WerFault.exe Token: SeDebugPrivilege 2132 WerFault.exe Token: SeDebugPrivilege 3872 WerFault.exe Token: SeDebugPrivilege 2324 WerFault.exe Token: SeDebugPrivilege 4032 WerFault.exe Token: SeDebugPrivilege 3664 WerFault.exe Token: SeDebugPrivilege 3556 WerFault.exe Token: SeDebugPrivilege 2832 WerFault.exe Token: SeDebugPrivilege 3608 WerFault.exe Token: SeDebugPrivilege 4012 WerFault.exe Token: SeDebugPrivilege 2220 WerFault.exe Token: SeDebugPrivilege 416 WerFault.exe Token: SeDebugPrivilege 4016 WerFault.exe Token: SeDebugPrivilege 2252 WerFault.exe Token: SeDebugPrivilege 3540 WerFault.exe Token: SeDebugPrivilege 796 WerFault.exe Token: SeDebugPrivilege 4000 WerFault.exe Token: SeDebugPrivilege 3996 WerFault.exe Token: SeDebugPrivilege 184 WerFault.exe Token: SeDebugPrivilege 676 WerFault.exe Token: SeDebugPrivilege 612 WerFault.exe Token: SeDebugPrivilege 2388 WerFault.exe Token: SeDebugPrivilege 2112 WerFault.exe Token: SeDebugPrivilege 3832 WerFault.exe Token: SeDebugPrivilege 3068 WerFault.exe Token: SeDebugPrivilege 848 WerFault.exe Token: SeDebugPrivilege 3752 WerFault.exe Token: SeDebugPrivilege 1040 WerFault.exe Token: SeDebugPrivilege 2156 WerFault.exe Token: SeDebugPrivilege 3028 WerFault.exe Token: SeDebugPrivilege 4008 WerFault.exe Token: SeDebugPrivilege 4024 WerFault.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 636 wrote to memory of 2304 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe 121 PID 636 wrote to memory of 2304 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe 121 PID 636 wrote to memory of 2304 636 2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe 121 PID 2304 wrote to memory of 1748 2304 cmd.exe 123 PID 2304 wrote to memory of 1748 2304 cmd.exe 123 PID 2304 wrote to memory of 1748 2304 cmd.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe"C:\Users\Admin\AppData\Local\Temp\2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 8162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 9002⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 7922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 11922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 11602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 12682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 8362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 12402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 13322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 13202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 13682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 11962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 14722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 15682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 14202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 15562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 14762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 14442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 14962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 15042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 13962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 13202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 13322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 18642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 17562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 18322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 18482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 11122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 13882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 18362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 18282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 17442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 19522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 18362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 18802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 12482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 20242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 19162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 19282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 17482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 11962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2681d4c9742631b3bddb5e9e7ca9956ceb966a6f694b0f706dfa90d8a4cf7ca4.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1748
-
-