Analysis
-
max time kernel
4294208s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
21-03-2022 09:00
Static task
static1
Behavioral task
behavioral1
Sample
9394c417afa9c6615a4aa929b062f420.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
9394c417afa9c6615a4aa929b062f420.exe
Resource
win10v2004-en-20220113
General
-
Target
9394c417afa9c6615a4aa929b062f420.exe
-
Size
210KB
-
MD5
9394c417afa9c6615a4aa929b062f420
-
SHA1
b63ec408e1d573ad34b0acca7821db58b9c9135d
-
SHA256
ebbf3b5a2fea9d1313ec35ce127db7dd86a7b6c55c241fcf3d7e2f7b167a7100
-
SHA512
9129389dcda5b669e8e3e13424d2fe9fa851b4daa1dfb68e5da1e57591d88ff52e9c534716bc337ef9b838d73faa71af3763ff11e000788ec21effe7b883b76b
Malware Config
Signatures
-
VKeylogger
A keylogger first seen in Nov 2020.
-
VKeylogger Payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1584-57-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1280-55-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1472-70-0x0000000000400000-0x000000000040F000-memory.dmp family_vkeylogger behavioral1/memory/1472-68-0x0000000000400000-0x000000000040F000-memory.dmp family_vkeylogger behavioral1/memory/1472-66-0x0000000000400000-0x000000000040F000-memory.dmp family_vkeylogger behavioral1/memory/1472-72-0x0000000000400000-0x000000000040F000-memory.dmp family_vkeylogger behavioral1/memory/432-74-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1148-89-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1844-105-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1048-107-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1620-123-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1240-126-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1376-142-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1728-144-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/892-160-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1304-175-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1568-190-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1684-192-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger behavioral1/memory/1608-208-0x0000000000230000-0x0000000000267000-memory.dmp family_vkeylogger -
Suspicious use of SetThreadContext 9 IoCs
Processes:
9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exedescription pid process target process PID 432 set thread context of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 set thread context of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 set thread context of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1620 set thread context of 1800 1620 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1376 set thread context of 1516 1376 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 892 set thread context of 1968 892 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1304 set thread context of 996 1304 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1568 set thread context of 1468 1568 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1608 set thread context of 768 1608 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe -
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 980 1472 WerFault.exe 9394c417afa9c6615a4aa929b062f420.exe 1116 1560 WerFault.exe 9394c417afa9c6615a4aa929b062f420.exe 1736 1576 WerFault.exe 9394c417afa9c6615a4aa929b062f420.exe 1672 1800 WerFault.exe 9394c417afa9c6615a4aa929b062f420.exe 1732 1516 WerFault.exe 9394c417afa9c6615a4aa929b062f420.exe 1840 1968 WerFault.exe 9394c417afa9c6615a4aa929b062f420.exe 1308 996 WerFault.exe 9394c417afa9c6615a4aa929b062f420.exe 1992 1468 WerFault.exe 9394c417afa9c6615a4aa929b062f420.exe 1520 768 WerFault.exe 9394c417afa9c6615a4aa929b062f420.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exepid process 432 9394c417afa9c6615a4aa929b062f420.exe 1148 9394c417afa9c6615a4aa929b062f420.exe 1844 9394c417afa9c6615a4aa929b062f420.exe 1620 9394c417afa9c6615a4aa929b062f420.exe 1376 9394c417afa9c6615a4aa929b062f420.exe 892 9394c417afa9c6615a4aa929b062f420.exe 1304 9394c417afa9c6615a4aa929b062f420.exe 1568 9394c417afa9c6615a4aa929b062f420.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exe9394c417afa9c6615a4aa929b062f420.exedescription pid process target process PID 1280 wrote to memory of 1584 1280 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1280 wrote to memory of 1584 1280 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1280 wrote to memory of 1584 1280 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1280 wrote to memory of 1584 1280 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1584 wrote to memory of 432 1584 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1584 wrote to memory of 432 1584 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1584 wrote to memory of 432 1584 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1584 wrote to memory of 432 1584 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1472 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1472 wrote to memory of 980 1472 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1472 wrote to memory of 980 1472 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1472 wrote to memory of 980 1472 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1472 wrote to memory of 980 1472 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 432 wrote to memory of 1148 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1148 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1148 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 432 wrote to memory of 1148 432 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1560 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1560 wrote to memory of 1116 1560 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1560 wrote to memory of 1116 1560 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1560 wrote to memory of 1116 1560 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1560 wrote to memory of 1116 1560 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1148 wrote to memory of 1844 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1844 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1844 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1148 wrote to memory of 1844 1148 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1576 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1576 wrote to memory of 1736 1576 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1576 wrote to memory of 1736 1576 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1576 wrote to memory of 1736 1576 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1576 wrote to memory of 1736 1576 9394c417afa9c6615a4aa929b062f420.exe WerFault.exe PID 1844 wrote to memory of 1048 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1048 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe PID 1844 wrote to memory of 1048 1844 9394c417afa9c6615a4aa929b062f420.exe 9394c417afa9c6615a4aa929b062f420.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 366⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 367⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 369⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 3611⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 3613⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 3614⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"14⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 3615⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"15⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 3617⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-74-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/892-160-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1048-107-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1048-108-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1148-89-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1148-90-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1240-127-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1240-126-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1280-55-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1280-73-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1304-175-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1376-142-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1472-64-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1472-66-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1472-62-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1472-60-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1472-70-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1472-68-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1472-72-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1568-190-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1584-58-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1584-57-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1608-208-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1620-124-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1620-123-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1684-192-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1684-195-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1728-145-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1728-144-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB
-
memory/1844-105-0x0000000000230000-0x0000000000267000-memory.dmpFilesize
220KB