Analysis
-
max time kernel
117s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2022, 23:38
Static task
static1
Behavioral task
behavioral1
Sample
2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe
-
Size
892KB
-
MD5
e77ef3eab706c0c437530b7400a05132
-
SHA1
8e0dacd1ba370dfd1d1ee56b02b0ae34f64094c8
-
SHA256
2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118
-
SHA512
ccbc9e1348ebb439ae88d8993283b54f512c96ed1f879b29e55d5afa23c04c3f67ad4720d5a7f31bbfc825da7a148101c834a8f46ce46f5b9ae2fe764354d770
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe" 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4712 2324 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1600 schtasks.exe 3500 schtasks.exe 4176 schtasks.exe 4432 schtasks.exe 4972 schtasks.exe 3632 schtasks.exe 3452 schtasks.exe 4052 schtasks.exe 3604 schtasks.exe 3896 schtasks.exe 3004 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 4924 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 84 PID 2324 wrote to memory of 4924 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 84 PID 2324 wrote to memory of 4924 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 84 PID 2324 wrote to memory of 4904 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 85 PID 2324 wrote to memory of 4904 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 85 PID 2324 wrote to memory of 4904 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 85 PID 2324 wrote to memory of 4864 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 97 PID 2324 wrote to memory of 4864 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 97 PID 2324 wrote to memory of 4864 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 97 PID 2324 wrote to memory of 4808 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 88 PID 2324 wrote to memory of 4808 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 88 PID 2324 wrote to memory of 4808 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 88 PID 2324 wrote to memory of 4788 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 90 PID 2324 wrote to memory of 4788 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 90 PID 2324 wrote to memory of 4788 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 90 PID 2324 wrote to memory of 4024 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 96 PID 2324 wrote to memory of 4024 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 96 PID 2324 wrote to memory of 4024 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 96 PID 2324 wrote to memory of 3988 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 94 PID 2324 wrote to memory of 3988 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 94 PID 2324 wrote to memory of 3988 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 94 PID 2324 wrote to memory of 3740 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 93 PID 2324 wrote to memory of 3740 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 93 PID 2324 wrote to memory of 3740 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 93 PID 2324 wrote to memory of 1632 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 99 PID 2324 wrote to memory of 1632 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 99 PID 2324 wrote to memory of 1632 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 99 PID 4924 wrote to memory of 4432 4924 cmd.exe 102 PID 4924 wrote to memory of 4432 4924 cmd.exe 102 PID 4924 wrote to memory of 4432 4924 cmd.exe 102 PID 2324 wrote to memory of 3176 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 100 PID 2324 wrote to memory of 3176 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 100 PID 2324 wrote to memory of 3176 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 100 PID 2324 wrote to memory of 392 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 103 PID 2324 wrote to memory of 392 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 103 PID 2324 wrote to memory of 392 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 103 PID 2324 wrote to memory of 2184 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 105 PID 2324 wrote to memory of 2184 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 105 PID 2324 wrote to memory of 2184 2324 2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe 105 PID 1632 wrote to memory of 4972 1632 cmd.exe 109 PID 1632 wrote to memory of 4972 1632 cmd.exe 109 PID 1632 wrote to memory of 4972 1632 cmd.exe 109 PID 4904 wrote to memory of 1600 4904 cmd.exe 110 PID 4904 wrote to memory of 1600 4904 cmd.exe 110 PID 4904 wrote to memory of 1600 4904 cmd.exe 110 PID 4864 wrote to memory of 3452 4864 cmd.exe 112 PID 4864 wrote to memory of 3452 4864 cmd.exe 112 PID 4864 wrote to memory of 3452 4864 cmd.exe 112 PID 4808 wrote to memory of 3632 4808 cmd.exe 111 PID 4808 wrote to memory of 3632 4808 cmd.exe 111 PID 4808 wrote to memory of 3632 4808 cmd.exe 111 PID 3988 wrote to memory of 3500 3988 cmd.exe 114 PID 3988 wrote to memory of 3500 3988 cmd.exe 114 PID 3988 wrote to memory of 3500 3988 cmd.exe 114 PID 4024 wrote to memory of 3896 4024 cmd.exe 116 PID 4024 wrote to memory of 3896 4024 cmd.exe 116 PID 4024 wrote to memory of 3896 4024 cmd.exe 116 PID 3176 wrote to memory of 4052 3176 cmd.exe 113 PID 3176 wrote to memory of 4052 3176 cmd.exe 113 PID 3176 wrote to memory of 4052 3176 cmd.exe 113 PID 4788 wrote to memory of 3604 4788 cmd.exe 115 PID 4788 wrote to memory of 3604 4788 cmd.exe 115 PID 4788 wrote to memory of 3604 4788 cmd.exe 115 PID 3740 wrote to memory of 4176 3740 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:4432
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:1600
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:3632
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:3604
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:4176
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:3500
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:3896
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:3452
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk641" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk641" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:4972
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk867" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk867" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:4052
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4615" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵PID:392
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7573" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"2⤵PID:2184
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7573" /TR "C:\Users\Admin\AppData\Local\Temp\2a8b79a0ab1bb31e45b15061dbcae3f33978ab343fbda3fb7932f578cd574118.exe"3⤵
- Creates scheduled task(s)
PID:3004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 14362⤵
- Program crash
PID:4712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2324 -ip 23241⤵PID:4672