Analysis
- max time kernel
134s - max time network
135s - platform
windows10_x64 - resource
win10v20201028 - submitted
12/11/2020, 14:14
Static task
static1
Behavioral task
behavioral1
Sample
6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe
- Size 512KB
- Sample201112-n32j3qz5ce
- SHA256 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5
- MD5 240971ad438507330eb673bb3e468aa0
- SHA1 4e2b93540067b39ea72251c5cc38b1a27d3d0942
- SHA512 2e32880134315a2b7e9137c2e8b9499ecf9cfe4dc13e3711dc9ce57d485ee1768e1c3a964f8e45f8a37d96819c7db9c449b811f19ee13795b298630f617dc04e
- MD5 SHA1 SHA512
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ab67-605.dat js - Program crash 36 IoCs
pid pid_target Process procid_target 2596 540 WerFault.exe 67 3656 540 WerFault.exe 67 2060 540 WerFault.exe 67 3672 540 WerFault.exe 67 936 540 WerFault.exe 67 3736 540 WerFault.exe 67 3240 540 WerFault.exe 67 2324 540 WerFault.exe 67 3160 540 WerFault.exe 67 188 540 WerFault.exe 67 1928 540 WerFault.exe 67 3812 540 WerFault.exe 67 496 540 WerFault.exe 67 704 540 WerFault.exe 67 1736 540 WerFault.exe 67 1908 540 WerFault.exe 67 3848 540 WerFault.exe 67 2412 540 WerFault.exe 67 192 540 WerFault.exe 67 1912 540 WerFault.exe 67 3176 540 WerFault.exe 67 2860 540 WerFault.exe 67 1092 540 WerFault.exe 67 4016 540 WerFault.exe 67 3904 540 WerFault.exe 67 1880 540 WerFault.exe 67 4044 540 WerFault.exe 67 3008 540 WerFault.exe 67 1476 540 WerFault.exe 67 2216 540 WerFault.exe 67 3856 540 WerFault.exe 67 1384 540 WerFault.exe 67 2140 540 WerFault.exe 67 3268 540 WerFault.exe 67 2264 540 WerFault.exe 67 2268 540 WerFault.exe 67 - Delays execution with timeout.exe 1 IoCs
pid Process 3572 timeout.exe - Suspicious behavior: EnumeratesProcesses 504 IoCs
pid Process 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 2596 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 3656 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 2060 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 3672 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 936 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 3240 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 3160 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 188 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 1928 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 3812 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 496 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 704 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1736 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 1908 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 3848 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 192 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 1912 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 3176 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 2860 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 1092 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 4016 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 3904 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 1880 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 4044 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 3008 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 1384 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 2140 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 3268 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2264 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe 2268 WerFault.exe - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeRestorePrivilege 2596 WerFault.exe Token: SeBackupPrivilege 2596 WerFault.exe Token: SeDebugPrivilege 2596 WerFault.exe Token: SeDebugPrivilege 3656 WerFault.exe Token: SeDebugPrivilege 2060 WerFault.exe Token: SeDebugPrivilege 3672 WerFault.exe Token: SeDebugPrivilege 936 WerFault.exe Token: SeDebugPrivilege 3736 WerFault.exe Token: SeDebugPrivilege 3240 WerFault.exe Token: SeDebugPrivilege 2324 WerFault.exe Token: SeDebugPrivilege 3160 WerFault.exe Token: SeDebugPrivilege 188 WerFault.exe Token: SeDebugPrivilege 1928 WerFault.exe Token: SeDebugPrivilege 3812 WerFault.exe Token: SeDebugPrivilege 496 WerFault.exe Token: SeDebugPrivilege 704 WerFault.exe Token: SeDebugPrivilege 1736 WerFault.exe Token: SeDebugPrivilege 1908 WerFault.exe Token: SeDebugPrivilege 3848 WerFault.exe Token: SeDebugPrivilege 2412 WerFault.exe Token: SeDebugPrivilege 192 WerFault.exe Token: SeDebugPrivilege 1912 WerFault.exe Token: SeDebugPrivilege 3176 WerFault.exe Token: SeDebugPrivilege 2860 WerFault.exe Token: SeDebugPrivilege 1092 WerFault.exe Token: SeDebugPrivilege 4016 WerFault.exe Token: SeDebugPrivilege 3904 WerFault.exe Token: SeDebugPrivilege 1880 WerFault.exe Token: SeDebugPrivilege 4044 WerFault.exe Token: SeDebugPrivilege 3008 WerFault.exe Token: SeDebugPrivilege 1476 WerFault.exe Token: SeDebugPrivilege 2216 WerFault.exe Token: SeDebugPrivilege 3856 WerFault.exe Token: SeDebugPrivilege 1384 WerFault.exe Token: SeDebugPrivilege 2140 WerFault.exe Token: SeDebugPrivilege 3268 WerFault.exe Token: SeDebugPrivilege 2264 WerFault.exe Token: SeDebugPrivilege 2268 WerFault.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 540 wrote to memory of 3100 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe 115 PID 540 wrote to memory of 3100 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe 115 PID 540 wrote to memory of 3100 540 6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe 115 PID 3100 wrote to memory of 3572 3100 cmd.exe 117 PID 3100 wrote to memory of 3572 3100 cmd.exe 117 PID 3100 wrote to memory of 3572 3100 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe"C:\Users\Admin\AppData\Local\Temp\6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 7402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 8162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 8962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 7442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 11922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 12082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 13002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 12402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 12722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 13802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 12922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 12042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 1282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 13082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 13282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 13242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 12322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 14802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 14202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 12682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 15002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 14042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 14522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 13442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 14802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 16482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 12762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 14682⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 13802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 16042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 15522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 16522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 13402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 17242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 12042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 15602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\6cabd0dd9752b745ec4364e3c47bf33510e6e4e2ebd95e5cd15b09d99883d4b5.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:3572
-
-