Analysis
-
max time kernel
76s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2022, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe
-
Size
906KB
-
MD5
57d17c6ca2529aeae944a9522e0d7d1a
-
SHA1
ee6d55578686078bacd7f8ef17092b103aa330dd
-
SHA256
7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43
-
SHA512
e5f3a0fe63f6904dddc7583abde6c3e98b58df91bb4cd83cfc426e14e100b9e434f7940afd1e7809088c2f808cc3ec2dfd3f8607f7194507dcbd8aa1e1d3f4c1
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe" 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4304 4244 WerFault.exe 83 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 396 schtasks.exe 3348 schtasks.exe 4800 schtasks.exe 3832 schtasks.exe 4328 schtasks.exe 3800 schtasks.exe 1444 schtasks.exe 4256 schtasks.exe 4040 schtasks.exe 4852 schtasks.exe 2756 schtasks.exe 5096 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4244 wrote to memory of 3640 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 85 PID 4244 wrote to memory of 3640 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 85 PID 4244 wrote to memory of 3640 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 85 PID 4244 wrote to memory of 2092 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 86 PID 4244 wrote to memory of 2092 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 86 PID 4244 wrote to memory of 2092 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 86 PID 4244 wrote to memory of 3948 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 108 PID 4244 wrote to memory of 3948 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 108 PID 4244 wrote to memory of 3948 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 108 PID 4244 wrote to memory of 5112 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 99 PID 4244 wrote to memory of 5112 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 99 PID 4244 wrote to memory of 5112 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 99 PID 4244 wrote to memory of 4072 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 98 PID 4244 wrote to memory of 4072 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 98 PID 4244 wrote to memory of 4072 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 98 PID 4244 wrote to memory of 616 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 97 PID 4244 wrote to memory of 616 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 97 PID 4244 wrote to memory of 616 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 97 PID 4244 wrote to memory of 3908 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 95 PID 4244 wrote to memory of 3908 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 95 PID 4244 wrote to memory of 3908 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 95 PID 4244 wrote to memory of 3464 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 92 PID 4244 wrote to memory of 3464 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 92 PID 4244 wrote to memory of 3464 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 92 PID 4244 wrote to memory of 4308 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 94 PID 4244 wrote to memory of 4308 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 94 PID 4244 wrote to memory of 4308 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 94 PID 4244 wrote to memory of 4208 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 100 PID 4244 wrote to memory of 4208 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 100 PID 4244 wrote to memory of 4208 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 100 PID 4244 wrote to memory of 4648 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 102 PID 4244 wrote to memory of 4648 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 102 PID 4244 wrote to memory of 4648 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 102 PID 4244 wrote to memory of 2364 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 103 PID 4244 wrote to memory of 2364 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 103 PID 4244 wrote to memory of 2364 4244 7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe 103 PID 5112 wrote to memory of 1444 5112 cmd.exe 109 PID 5112 wrote to memory of 1444 5112 cmd.exe 109 PID 5112 wrote to memory of 1444 5112 cmd.exe 109 PID 2092 wrote to memory of 396 2092 cmd.exe 110 PID 2092 wrote to memory of 396 2092 cmd.exe 110 PID 2092 wrote to memory of 396 2092 cmd.exe 110 PID 3640 wrote to memory of 3348 3640 cmd.exe 111 PID 3640 wrote to memory of 3348 3640 cmd.exe 111 PID 3640 wrote to memory of 3348 3640 cmd.exe 111 PID 616 wrote to memory of 4256 616 cmd.exe 113 PID 616 wrote to memory of 4256 616 cmd.exe 113 PID 616 wrote to memory of 4256 616 cmd.exe 113 PID 3948 wrote to memory of 4800 3948 cmd.exe 112 PID 3948 wrote to memory of 4800 3948 cmd.exe 112 PID 3948 wrote to memory of 4800 3948 cmd.exe 112 PID 3908 wrote to memory of 3832 3908 cmd.exe 115 PID 3908 wrote to memory of 3832 3908 cmd.exe 115 PID 3908 wrote to memory of 3832 3908 cmd.exe 115 PID 4072 wrote to memory of 4040 4072 cmd.exe 114 PID 4072 wrote to memory of 4040 4072 cmd.exe 114 PID 4072 wrote to memory of 4040 4072 cmd.exe 114 PID 4308 wrote to memory of 4852 4308 cmd.exe 117 PID 4308 wrote to memory of 4852 4308 cmd.exe 117 PID 4308 wrote to memory of 4852 4308 cmd.exe 117 PID 3464 wrote to memory of 4328 3464 cmd.exe 116 PID 3464 wrote to memory of 4328 3464 cmd.exe 116 PID 3464 wrote to memory of 4328 3464 cmd.exe 116 PID 4648 wrote to memory of 5096 4648 cmd.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:3348
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:396
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:4328
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk392" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk392" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:4852
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:3832
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:4256
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:4040
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:1444
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7381" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵PID:4208
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7381" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:2756
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4530" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4530" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:5096
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4836" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵PID:2364
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4836" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:3800
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\7d581121527b8965ef1d34d4f586e97a9838a35cd20be121d417b6710d839f43.exe"3⤵
- Creates scheduled task(s)
PID:4800
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 10122⤵
- Program crash
PID:4304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4244 -ip 42441⤵PID:4888