Analysis
- max time kernel
16s - max time network
134s - platform
windows10_x64 - resource
win10-en - submitted
01/09/2021, 20:10
Static task
static1
Behavioral task
behavioral1
Sample
bf9449b1015153fe62837aad93d2eba8.exe
Resource
win7-en
windows7_x64
0 signatures
0 seconds
General
- Target bf9449b1015153fe62837aad93d2eba8.exe
- Size 4.4MB
- Sample210901-3r48st7dee
- SHA256 68d83afa2dc4272e54c4ebb1ab8981e7f00442dfe6e66c8b7299c30a230be997
- MD5 bf9449b1015153fe62837aad93d2eba8
- SHA1 e1637f3aa2d78d91ffa7409ca0823c96d2eb8941
- SHA512 687984a9c1f2a6c6a15b62b20ac7447ff5a3d7db3b22fc52e2c0b0500ac000e9efe6886481aac94103e38184fb9eb92319f46e31eeefb6e614662a5e2e97acab
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
metasploit
Version
-
windows/single_exec
Signatures
- Glupteba Payload 3 IoCs
resource yara_rule behavioral2/memory/3548-115-0x00000000047E0000-0x0000000005107000-memory.dmp family_glupteba behavioral2/memory/3548-116-0x0000000000400000-0x0000000002587000-memory.dmp family_glupteba behavioral2/memory/1776-118-0x0000000000400000-0x0000000002587000-memory.dmp family_glupteba - MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3932 created 3548 3932 svchost.exe 68 - Program crash 37 IoCs
pid pid_target Process procid_target 3172 3548 WerFault.exe 68 1304 3548 WerFault.exe 68 3092 3548 WerFault.exe 68 1760 3548 WerFault.exe 68 592 3548 WerFault.exe 68 2328 3548 WerFault.exe 68 3896 3548 WerFault.exe 68 1336 3548 WerFault.exe 68 2380 3548 WerFault.exe 68 2688 3548 WerFault.exe 68 3980 3548 WerFault.exe 68 3784 3548 WerFault.exe 68 1420 3548 WerFault.exe 68 2036 3548 WerFault.exe 68 3876 3548 WerFault.exe 68 2328 3548 WerFault.exe 68 3848 3548 WerFault.exe 68 2376 3548 WerFault.exe 68 2416 3548 WerFault.exe 68 2600 3548 WerFault.exe 68 3692 3548 WerFault.exe 68 1336 1776 WerFault.exe 100 3896 1776 WerFault.exe 100 2264 1776 WerFault.exe 100 2588 1776 WerFault.exe 100 2184 1776 WerFault.exe 100 3716 1776 WerFault.exe 100 3636 1776 WerFault.exe 100 1688 1776 WerFault.exe 100 616 1776 WerFault.exe 100 2140 1776 WerFault.exe 100 3820 1776 WerFault.exe 100 2688 1776 WerFault.exe 100 2664 1776 WerFault.exe 100 3092 1776 WerFault.exe 100 3556 1776 WerFault.exe 100 1436 1776 WerFault.exe 100 - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" bf9449b1015153fe62837aad93d2eba8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" bf9449b1015153fe62837aad93d2eba8.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3548 bf9449b1015153fe62837aad93d2eba8.exe 3548 bf9449b1015153fe62837aad93d2eba8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3548 bf9449b1015153fe62837aad93d2eba8.exe Token: SeImpersonatePrivilege 3548 bf9449b1015153fe62837aad93d2eba8.exe Token: SeTcbPrivilege 3932 svchost.exe Token: SeTcbPrivilege 3932 svchost.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3932 wrote to memory of 1776 3932 svchost.exe 100 PID 3932 wrote to memory of 1776 3932 svchost.exe 100 PID 3932 wrote to memory of 1776 3932 svchost.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf9449b1015153fe62837aad93d2eba8.exe"C:\Users\Admin\AppData\Local\Temp\bf9449b1015153fe62837aad93d2eba8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 3922⤵
- Program crash
PID:3172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 4042⤵
- Program crash
PID:1304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 4282⤵
- Program crash
PID:3092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 5882⤵
- Program crash
PID:1760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 6642⤵
- Program crash
PID:592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 7002⤵
- Program crash
PID:2328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 6402⤵
- Program crash
PID:3896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 7122⤵
- Program crash
PID:1336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 7722⤵
- Program crash
PID:2380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 8042⤵
- Program crash
PID:2688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 7842⤵
- Program crash
PID:3980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 7242⤵
- Program crash
PID:3784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 7202⤵
- Program crash
PID:1420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 8522⤵
- Program crash
PID:2036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 9162⤵
- Program crash
PID:3876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 6842⤵
- Program crash
PID:2328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 6202⤵
- Program crash
PID:3848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 6522⤵
- Program crash
PID:2376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 7722⤵
- Program crash
PID:2416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 7722⤵
- Program crash
PID:2600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 8442⤵
- Program crash
PID:3692
-
-
C:\Users\Admin\AppData\Local\Temp\bf9449b1015153fe62837aad93d2eba8.exe"C:\Users\Admin\AppData\Local\Temp\bf9449b1015153fe62837aad93d2eba8.exe"2⤵
- Modifies data under HKEY_USERS
PID:1776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 3523⤵
- Program crash
PID:1336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 3403⤵
- Program crash
PID:3896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 3923⤵
- Program crash
PID:2264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 6203⤵
- Program crash
PID:2588
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 6603⤵
- Program crash
PID:2184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 7003⤵
- Program crash
PID:3716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 7283⤵
- Program crash
PID:3636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 5843⤵
- Program crash
PID:1688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 5163⤵
- Program crash
PID:616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 5603⤵
- Program crash
PID:2140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 6683⤵
- Program crash
PID:3820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 5923⤵
- Program crash
PID:2688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 8403⤵
- Program crash
PID:2664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 7963⤵
- Program crash
PID:3092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 6243⤵
- Program crash
PID:3556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 9083⤵
- Program crash
PID:1436
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932