Analysis
- max time kernel
83s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
622a5a45bb1ca80c65ac9ba3f10ef053.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 622a5a45bb1ca80c65ac9ba3f10ef053.exe
- Size 512KB
- Sample201117-36d5m3z5ce
- SHA256 756e7cb702fa69a36bdb3a99b16d2bb2f8cdb97f7f41d7b50bbc19f58ff6b356
- MD5 6d2f2cccb0eff69cd6907abae041d6f4
- SHA1 ee469791fe121842a9796e47cf40a16592af4b2a
- SHA512 57ee113cd9b70d6640dd564807a90d71f60b30d344e7e9077a4fcd0e10177aa7a6a5eab3a0ba3b303cbe7a413ed19b570bcfaef9189636ecea8f7cae76963edf
- MD5 SHA1 SHA512
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000400000001ab7d-202.dat js - Program crash 36 IoCs
pid pid_target Process procid_target 2480 732 WerFault.exe 67 416 732 WerFault.exe 67 2512 732 WerFault.exe 67 200 732 WerFault.exe 67 3560 732 WerFault.exe 67 3604 732 WerFault.exe 67 1476 732 WerFault.exe 67 796 732 WerFault.exe 67 3832 732 WerFault.exe 67 1704 732 WerFault.exe 67 2980 732 WerFault.exe 67 1852 732 WerFault.exe 67 2284 732 WerFault.exe 67 3844 732 WerFault.exe 67 2564 732 WerFault.exe 67 2920 732 WerFault.exe 67 2172 732 WerFault.exe 67 2676 732 WerFault.exe 67 3212 732 WerFault.exe 67 1728 732 WerFault.exe 67 1840 732 WerFault.exe 67 3044 732 WerFault.exe 67 3660 732 WerFault.exe 67 1404 732 WerFault.exe 67 1472 732 WerFault.exe 67 3984 732 WerFault.exe 67 3816 732 WerFault.exe 67 1508 732 WerFault.exe 67 576 732 WerFault.exe 67 3308 732 WerFault.exe 67 3944 732 WerFault.exe 67 3596 732 WerFault.exe 67 1296 732 WerFault.exe 67 508 732 WerFault.exe 67 1980 732 WerFault.exe 67 3768 732 WerFault.exe 67 - Delays execution with timeout.exe 1 IoCs
pid Process 1184 timeout.exe - Suspicious behavior: EnumeratesProcesses 509 IoCs
pid Process 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 2512 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3560 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 3604 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 3832 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 2980 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 1852 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 2284 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 3844 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2564 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2920 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2172 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 3212 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 1840 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3044 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 3660 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3984 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 3816 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 1508 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3308 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3944 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 3596 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 1296 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 508 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 1980 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe 3768 WerFault.exe - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeRestorePrivilege 2480 WerFault.exe Token: SeBackupPrivilege 2480 WerFault.exe Token: SeDebugPrivilege 2480 WerFault.exe Token: SeDebugPrivilege 416 WerFault.exe Token: SeDebugPrivilege 2512 WerFault.exe Token: SeDebugPrivilege 200 WerFault.exe Token: SeDebugPrivilege 3560 WerFault.exe Token: SeDebugPrivilege 3604 WerFault.exe Token: SeDebugPrivilege 1476 WerFault.exe Token: SeDebugPrivilege 796 WerFault.exe Token: SeDebugPrivilege 3832 WerFault.exe Token: SeDebugPrivilege 1704 WerFault.exe Token: SeDebugPrivilege 2980 WerFault.exe Token: SeDebugPrivilege 1852 WerFault.exe Token: SeDebugPrivilege 2284 WerFault.exe Token: SeDebugPrivilege 3844 WerFault.exe Token: SeDebugPrivilege 2564 WerFault.exe Token: SeDebugPrivilege 2920 WerFault.exe Token: SeDebugPrivilege 2172 WerFault.exe Token: SeDebugPrivilege 2676 WerFault.exe Token: SeDebugPrivilege 3212 WerFault.exe Token: SeDebugPrivilege 1728 WerFault.exe Token: SeDebugPrivilege 1840 WerFault.exe Token: SeDebugPrivilege 3044 WerFault.exe Token: SeDebugPrivilege 3660 WerFault.exe Token: SeDebugPrivilege 1404 WerFault.exe Token: SeDebugPrivilege 1472 WerFault.exe Token: SeDebugPrivilege 3984 WerFault.exe Token: SeDebugPrivilege 3816 WerFault.exe Token: SeDebugPrivilege 1508 WerFault.exe Token: SeDebugPrivilege 576 WerFault.exe Token: SeDebugPrivilege 3308 WerFault.exe Token: SeDebugPrivilege 3944 WerFault.exe Token: SeDebugPrivilege 3596 WerFault.exe Token: SeDebugPrivilege 1296 WerFault.exe Token: SeDebugPrivilege 508 WerFault.exe Token: SeDebugPrivilege 1980 WerFault.exe Token: SeDebugPrivilege 3768 WerFault.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 732 wrote to memory of 1340 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe 115 PID 732 wrote to memory of 1340 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe 115 PID 732 wrote to memory of 1340 732 622a5a45bb1ca80c65ac9ba3f10ef053.exe 115 PID 1340 wrote to memory of 1184 1340 cmd.exe 117 PID 1340 wrote to memory of 1184 1340 cmd.exe 117 PID 1340 wrote to memory of 1184 1340 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\622a5a45bb1ca80c65ac9ba3f10ef053.exe"C:\Users\Admin\AppData\Local\Temp\622a5a45bb1ca80c65ac9ba3f10ef053.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 7362⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 8122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 8922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 9122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 11882⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 12802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 12962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 13202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 14242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 15242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 14722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 14002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 14482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 15402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 14882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 16362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 15842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 15522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 16482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 14722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 16762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 15522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 16362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 13442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 16362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 17522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 16522⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 11882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 15082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 13122⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 13842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 17042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 8242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 17162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:508
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 15762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 12842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\622a5a45bb1ca80c65ac9ba3f10ef053.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1184
-
-