Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2022, 02:23
Static task
static1
Behavioral task
behavioral1
Sample
b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe
-
Size
929KB
-
MD5
f658f1f7e546d3a5e2873c90bc324222
-
SHA1
56063b8982dd2a5efd6e9927238b40d99767a504
-
SHA256
b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0
-
SHA512
4b28d8f027868401504e202cf6f0032ec75dec85c87d6d4666c20fd7e7306e43d25f4fa037dc4c872dc1c49ec07d9f12430fe72c0754c95d2805b2274425da22
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe" b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4648 4736 WerFault.exe 76 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1920 schtasks.exe 4896 schtasks.exe 1420 schtasks.exe 3836 schtasks.exe 3160 schtasks.exe 3484 schtasks.exe 448 schtasks.exe 4704 schtasks.exe 740 schtasks.exe 4960 schtasks.exe 4920 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4736 wrote to memory of 2496 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 77 PID 4736 wrote to memory of 2496 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 77 PID 4736 wrote to memory of 2496 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 77 PID 4736 wrote to memory of 4868 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 78 PID 4736 wrote to memory of 4868 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 78 PID 4736 wrote to memory of 4868 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 78 PID 4736 wrote to memory of 2288 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 79 PID 4736 wrote to memory of 2288 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 79 PID 4736 wrote to memory of 2288 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 79 PID 4736 wrote to memory of 3812 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 81 PID 4736 wrote to memory of 3812 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 81 PID 4736 wrote to memory of 3812 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 81 PID 4736 wrote to memory of 3700 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 83 PID 4736 wrote to memory of 3700 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 83 PID 4736 wrote to memory of 3700 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 83 PID 4736 wrote to memory of 928 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 99 PID 4736 wrote to memory of 928 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 99 PID 4736 wrote to memory of 928 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 99 PID 4736 wrote to memory of 4752 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 85 PID 4736 wrote to memory of 4752 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 85 PID 4736 wrote to memory of 4752 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 85 PID 4736 wrote to memory of 1548 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 86 PID 4736 wrote to memory of 1548 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 86 PID 4736 wrote to memory of 1548 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 86 PID 4736 wrote to memory of 3900 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 87 PID 4736 wrote to memory of 3900 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 87 PID 4736 wrote to memory of 3900 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 87 PID 4736 wrote to memory of 2364 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 88 PID 4736 wrote to memory of 2364 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 88 PID 4736 wrote to memory of 2364 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 88 PID 4736 wrote to memory of 3412 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 89 PID 4736 wrote to memory of 3412 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 89 PID 4736 wrote to memory of 3412 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 89 PID 4736 wrote to memory of 380 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 91 PID 4736 wrote to memory of 380 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 91 PID 4736 wrote to memory of 380 4736 b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe 91 PID 3700 wrote to memory of 1920 3700 cmd.exe 104 PID 3700 wrote to memory of 1920 3700 cmd.exe 104 PID 3700 wrote to memory of 1920 3700 cmd.exe 104 PID 2496 wrote to memory of 3484 2496 cmd.exe 103 PID 2496 wrote to memory of 3484 2496 cmd.exe 103 PID 2496 wrote to memory of 3484 2496 cmd.exe 103 PID 2288 wrote to memory of 4960 2288 cmd.exe 102 PID 2288 wrote to memory of 4960 2288 cmd.exe 102 PID 2288 wrote to memory of 4960 2288 cmd.exe 102 PID 4868 wrote to memory of 3160 4868 cmd.exe 101 PID 4868 wrote to memory of 3160 4868 cmd.exe 101 PID 4868 wrote to memory of 3160 4868 cmd.exe 101 PID 3900 wrote to memory of 740 3900 cmd.exe 111 PID 3900 wrote to memory of 740 3900 cmd.exe 111 PID 3900 wrote to memory of 740 3900 cmd.exe 111 PID 3812 wrote to memory of 3836 3812 cmd.exe 110 PID 3812 wrote to memory of 3836 3812 cmd.exe 110 PID 3812 wrote to memory of 3836 3812 cmd.exe 110 PID 2364 wrote to memory of 4704 2364 cmd.exe 109 PID 2364 wrote to memory of 4704 2364 cmd.exe 109 PID 2364 wrote to memory of 4704 2364 cmd.exe 109 PID 928 wrote to memory of 4920 928 cmd.exe 105 PID 928 wrote to memory of 4920 928 cmd.exe 105 PID 928 wrote to memory of 4920 928 cmd.exe 105 PID 1548 wrote to memory of 1420 1548 cmd.exe 108 PID 1548 wrote to memory of 1420 1548 cmd.exe 108 PID 1548 wrote to memory of 1420 1548 cmd.exe 108 PID 4752 wrote to memory of 448 4752 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:3484
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:3160
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:4960
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:3836
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:1920
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:448
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:1420
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1688" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1688" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:740
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2147" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2147" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:4704
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2506" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵PID:3412
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2506" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:4896
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4151" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵PID:380
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\b54da190fdf3f3e96961e0ee3b7269b61f449a4e3d0ea092cc42e486530d95a0.exe"3⤵
- Creates scheduled task(s)
PID:4920
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 13722⤵
- Program crash
PID:4648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4736 -ip 47361⤵PID:1220