Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2022, 03:01
Static task
static1
Behavioral task
behavioral1
Sample
ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe
-
Size
880KB
-
MD5
4ce22d91fccdfcb175ccf91f31d45290
-
SHA1
cdcd5df0c039fe47e3891fd2d6cefe83e2ce38aa
-
SHA256
ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102
-
SHA512
c48d187e7cf4d541da2422b65bd00a23f589b90b1256eb53b481dfddd991ebba7d7f32b30521d152ec21e67ca7ebb897a1725d71c1d06ac5a2fbd486de34dbae
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe" ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1644 1340 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1840 schtasks.exe 1892 schtasks.exe 4752 schtasks.exe 2116 schtasks.exe 772 schtasks.exe 5092 schtasks.exe 3232 schtasks.exe 4940 schtasks.exe 3628 schtasks.exe 5048 schtasks.exe 3248 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 2848 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 83 PID 1340 wrote to memory of 2848 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 83 PID 1340 wrote to memory of 2848 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 83 PID 1340 wrote to memory of 212 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 84 PID 1340 wrote to memory of 212 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 84 PID 1340 wrote to memory of 212 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 84 PID 1340 wrote to memory of 3728 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 85 PID 1340 wrote to memory of 3728 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 85 PID 1340 wrote to memory of 3728 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 85 PID 1340 wrote to memory of 220 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 88 PID 1340 wrote to memory of 220 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 88 PID 1340 wrote to memory of 220 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 88 PID 1340 wrote to memory of 4488 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 96 PID 1340 wrote to memory of 4488 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 96 PID 1340 wrote to memory of 4488 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 96 PID 1340 wrote to memory of 1880 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 90 PID 1340 wrote to memory of 1880 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 90 PID 1340 wrote to memory of 1880 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 90 PID 1340 wrote to memory of 2612 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 91 PID 1340 wrote to memory of 2612 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 91 PID 1340 wrote to memory of 2612 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 91 PID 1340 wrote to memory of 4700 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 92 PID 1340 wrote to memory of 4700 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 92 PID 1340 wrote to memory of 4700 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 92 PID 1340 wrote to memory of 1072 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 97 PID 1340 wrote to memory of 1072 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 97 PID 1340 wrote to memory of 1072 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 97 PID 1340 wrote to memory of 2356 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 99 PID 1340 wrote to memory of 2356 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 99 PID 1340 wrote to memory of 2356 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 99 PID 1340 wrote to memory of 940 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 102 PID 1340 wrote to memory of 940 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 102 PID 1340 wrote to memory of 940 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 102 PID 1340 wrote to memory of 1324 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 105 PID 1340 wrote to memory of 1324 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 105 PID 1340 wrote to memory of 1324 1340 ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe 105 PID 1072 wrote to memory of 1840 1072 cmd.exe 116 PID 1072 wrote to memory of 1840 1072 cmd.exe 116 PID 1072 wrote to memory of 1840 1072 cmd.exe 116 PID 2356 wrote to memory of 2116 2356 cmd.exe 108 PID 2356 wrote to memory of 2116 2356 cmd.exe 108 PID 2356 wrote to memory of 2116 2356 cmd.exe 108 PID 1880 wrote to memory of 4940 1880 cmd.exe 110 PID 1880 wrote to memory of 4940 1880 cmd.exe 110 PID 1880 wrote to memory of 4940 1880 cmd.exe 110 PID 220 wrote to memory of 3628 220 cmd.exe 111 PID 220 wrote to memory of 3628 220 cmd.exe 111 PID 220 wrote to memory of 3628 220 cmd.exe 111 PID 940 wrote to memory of 5092 940 cmd.exe 112 PID 940 wrote to memory of 5092 940 cmd.exe 112 PID 940 wrote to memory of 5092 940 cmd.exe 112 PID 3728 wrote to memory of 3248 3728 cmd.exe 114 PID 3728 wrote to memory of 3248 3728 cmd.exe 114 PID 3728 wrote to memory of 3248 3728 cmd.exe 114 PID 2848 wrote to memory of 4752 2848 cmd.exe 107 PID 2848 wrote to memory of 4752 2848 cmd.exe 107 PID 2848 wrote to memory of 4752 2848 cmd.exe 107 PID 4488 wrote to memory of 3232 4488 cmd.exe 115 PID 4488 wrote to memory of 3232 4488 cmd.exe 115 PID 4488 wrote to memory of 3232 4488 cmd.exe 115 PID 4700 wrote to memory of 1892 4700 cmd.exe 117 PID 4700 wrote to memory of 1892 4700 cmd.exe 117 PID 4700 wrote to memory of 1892 4700 cmd.exe 117 PID 212 wrote to memory of 5048 212 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:4752
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:5048
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:3248
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:3628
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:4940
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵PID:2612
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:772
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:1892
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:3232
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6742" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6742" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:1840
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4825" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4825" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:2116
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk772" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk772" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"3⤵
- Creates scheduled task(s)
PID:5092
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9311" /TR "C:\Users\Admin\AppData\Local\Temp\ddd213efe0f9d2cc8477ccbce9037002f87b5fbf63d99a171d58fb438009a102.exe"2⤵PID:1324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 11402⤵
- Program crash
PID:1644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1340 -ip 13401⤵PID:876