Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2022, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe
-
Size
891KB
-
MD5
c360675e5fe568e3caacb274029010c9
-
SHA1
6199478d0be9f5a15de1b9c455c60bbd2c6be685
-
SHA256
d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735
-
SHA512
140c9a32556a4bea3a4d44e2e7c8be559044ac8bbf144b2f17a0fd78cd126449e79c546992078179bea5531fab687232d9323f09b747ed31c308c2e3bf181eff
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe" d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2748 900 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4024 schtasks.exe 3860 schtasks.exe 3640 schtasks.exe 2068 schtasks.exe 4872 schtasks.exe 4256 schtasks.exe 4728 schtasks.exe 3988 schtasks.exe 3516 schtasks.exe 3488 schtasks.exe 4128 schtasks.exe 4788 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 900 wrote to memory of 1716 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 84 PID 900 wrote to memory of 1716 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 84 PID 900 wrote to memory of 1716 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 84 PID 900 wrote to memory of 4272 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 85 PID 900 wrote to memory of 4272 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 85 PID 900 wrote to memory of 4272 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 85 PID 900 wrote to memory of 4288 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 102 PID 900 wrote to memory of 4288 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 102 PID 900 wrote to memory of 4288 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 102 PID 900 wrote to memory of 5116 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 88 PID 900 wrote to memory of 5116 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 88 PID 900 wrote to memory of 5116 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 88 PID 900 wrote to memory of 4300 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 101 PID 900 wrote to memory of 4300 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 101 PID 900 wrote to memory of 4300 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 101 PID 900 wrote to memory of 1108 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 90 PID 900 wrote to memory of 1108 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 90 PID 900 wrote to memory of 1108 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 90 PID 900 wrote to memory of 2872 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 99 PID 900 wrote to memory of 2872 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 99 PID 900 wrote to memory of 2872 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 99 PID 900 wrote to memory of 2568 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 92 PID 900 wrote to memory of 2568 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 92 PID 900 wrote to memory of 2568 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 92 PID 900 wrote to memory of 1076 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 93 PID 900 wrote to memory of 1076 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 93 PID 900 wrote to memory of 1076 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 93 PID 900 wrote to memory of 2008 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 94 PID 900 wrote to memory of 2008 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 94 PID 900 wrote to memory of 2008 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 94 PID 1716 wrote to memory of 4024 1716 cmd.exe 103 PID 1716 wrote to memory of 4024 1716 cmd.exe 103 PID 1716 wrote to memory of 4024 1716 cmd.exe 103 PID 900 wrote to memory of 4528 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 104 PID 900 wrote to memory of 4528 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 104 PID 900 wrote to memory of 4528 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 104 PID 900 wrote to memory of 932 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 105 PID 900 wrote to memory of 932 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 105 PID 900 wrote to memory of 932 900 d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe 105 PID 2568 wrote to memory of 4728 2568 cmd.exe 109 PID 2568 wrote to memory of 4728 2568 cmd.exe 109 PID 2568 wrote to memory of 4728 2568 cmd.exe 109 PID 2872 wrote to memory of 3988 2872 cmd.exe 110 PID 2872 wrote to memory of 3988 2872 cmd.exe 110 PID 2872 wrote to memory of 3988 2872 cmd.exe 110 PID 4272 wrote to memory of 3860 4272 cmd.exe 111 PID 4272 wrote to memory of 3860 4272 cmd.exe 111 PID 4272 wrote to memory of 3860 4272 cmd.exe 111 PID 5116 wrote to memory of 4128 5116 cmd.exe 116 PID 5116 wrote to memory of 4128 5116 cmd.exe 116 PID 5116 wrote to memory of 4128 5116 cmd.exe 116 PID 4300 wrote to memory of 3640 4300 cmd.exe 112 PID 4300 wrote to memory of 3640 4300 cmd.exe 112 PID 4300 wrote to memory of 3640 4300 cmd.exe 112 PID 1108 wrote to memory of 2068 1108 cmd.exe 115 PID 1108 wrote to memory of 2068 1108 cmd.exe 115 PID 1108 wrote to memory of 2068 1108 cmd.exe 115 PID 4288 wrote to memory of 3488 4288 cmd.exe 114 PID 4288 wrote to memory of 3488 4288 cmd.exe 114 PID 4288 wrote to memory of 3488 4288 cmd.exe 114 PID 1076 wrote to memory of 3516 1076 cmd.exe 113 PID 1076 wrote to memory of 3516 1076 cmd.exe 113 PID 1076 wrote to memory of 3516 1076 cmd.exe 113 PID 2008 wrote to memory of 4788 2008 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:4024
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:3860
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:4128
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:2068
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:4728
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7163" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7163" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:3516
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3746" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3746" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:4788
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:3988
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:3640
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:3488
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8531" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵PID:4528
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8531" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:4872
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6206" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"2⤵PID:932
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6206" /TR "C:\Users\Admin\AppData\Local\Temp\d3dd1c4c8d30f9e3e180a03c5b79280176d04e9e7b68b7b746c0ea54ebfad735.exe"3⤵
- Creates scheduled task(s)
PID:4256
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 10362⤵
- Program crash
PID:2748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 900 -ip 9001⤵PID:3908