Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2022, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe
-
Size
950KB
-
MD5
2aae2893b7b319125c8ed531d7075f04
-
SHA1
46f388d5e211132f97b95c2d13bd4ee793d6119a
-
SHA256
329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd
-
SHA512
7aa49d3b3863dda17d27c5944211d76176f6fec2b2edd025f1605775b9a09687d7f355f998324c86f4f95b0d7e20e55bec9ffdc8fe3aab6bacd601ecc73796fe
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe" 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1232 4480 WerFault.exe 81 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1184 schtasks.exe 2208 schtasks.exe 4360 schtasks.exe 4264 schtasks.exe 2808 schtasks.exe 4612 schtasks.exe 1004 schtasks.exe 3320 schtasks.exe 528 schtasks.exe 4200 schtasks.exe 4624 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 4900 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 82 PID 4480 wrote to memory of 4900 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 82 PID 4480 wrote to memory of 4900 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 82 PID 4480 wrote to memory of 4788 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 83 PID 4480 wrote to memory of 4788 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 83 PID 4480 wrote to memory of 4788 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 83 PID 4480 wrote to memory of 2432 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 85 PID 4480 wrote to memory of 2432 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 85 PID 4480 wrote to memory of 2432 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 85 PID 4480 wrote to memory of 2412 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 87 PID 4480 wrote to memory of 2412 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 87 PID 4480 wrote to memory of 2412 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 87 PID 4480 wrote to memory of 1116 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 88 PID 4480 wrote to memory of 1116 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 88 PID 4480 wrote to memory of 1116 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 88 PID 4480 wrote to memory of 1940 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 90 PID 4480 wrote to memory of 1940 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 90 PID 4480 wrote to memory of 1940 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 90 PID 4480 wrote to memory of 1428 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 92 PID 4480 wrote to memory of 1428 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 92 PID 4480 wrote to memory of 1428 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 92 PID 4480 wrote to memory of 2212 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 93 PID 4480 wrote to memory of 2212 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 93 PID 4480 wrote to memory of 2212 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 93 PID 4480 wrote to memory of 3580 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 95 PID 4480 wrote to memory of 3580 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 95 PID 4480 wrote to memory of 3580 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 95 PID 4900 wrote to memory of 3320 4900 cmd.exe 104 PID 4900 wrote to memory of 3320 4900 cmd.exe 104 PID 4900 wrote to memory of 3320 4900 cmd.exe 104 PID 4480 wrote to memory of 4628 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 97 PID 4480 wrote to memory of 4628 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 97 PID 4480 wrote to memory of 4628 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 97 PID 4480 wrote to memory of 4224 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 103 PID 4480 wrote to memory of 4224 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 103 PID 4480 wrote to memory of 4224 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 103 PID 4480 wrote to memory of 3864 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 99 PID 4480 wrote to memory of 3864 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 99 PID 4480 wrote to memory of 3864 4480 329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe 99 PID 4628 wrote to memory of 4360 4628 cmd.exe 106 PID 4628 wrote to memory of 4360 4628 cmd.exe 106 PID 4628 wrote to memory of 4360 4628 cmd.exe 106 PID 4788 wrote to memory of 528 4788 cmd.exe 108 PID 4788 wrote to memory of 528 4788 cmd.exe 108 PID 4788 wrote to memory of 528 4788 cmd.exe 108 PID 2432 wrote to memory of 4264 2432 cmd.exe 109 PID 2432 wrote to memory of 4264 2432 cmd.exe 109 PID 2432 wrote to memory of 4264 2432 cmd.exe 109 PID 2412 wrote to memory of 2808 2412 cmd.exe 110 PID 2412 wrote to memory of 2808 2412 cmd.exe 110 PID 2412 wrote to memory of 2808 2412 cmd.exe 110 PID 3864 wrote to memory of 4624 3864 cmd.exe 113 PID 3864 wrote to memory of 4624 3864 cmd.exe 113 PID 3864 wrote to memory of 4624 3864 cmd.exe 113 PID 1940 wrote to memory of 4612 1940 cmd.exe 112 PID 1940 wrote to memory of 4612 1940 cmd.exe 112 PID 1940 wrote to memory of 4612 1940 cmd.exe 112 PID 2212 wrote to memory of 4200 2212 cmd.exe 111 PID 2212 wrote to memory of 4200 2212 cmd.exe 111 PID 2212 wrote to memory of 4200 2212 cmd.exe 111 PID 4224 wrote to memory of 1004 4224 cmd.exe 115 PID 4224 wrote to memory of 1004 4224 cmd.exe 115 PID 4224 wrote to memory of 1004 4224 cmd.exe 115 PID 1116 wrote to memory of 1184 1116 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:3320
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:528
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:4264
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:2808
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:1184
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:4612
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵PID:1428
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:2208
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:4200
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4636" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵PID:3580
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk521" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk521" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:4360
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5838" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5838" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:4624
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5077" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5077" /TR "C:\Users\Admin\AppData\Local\Temp\329b64f56196a927417e79b5a03e744f6867826f94dc8f1dd32de12e03671efd.exe"3⤵
- Creates scheduled task(s)
PID:1004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 10402⤵
- Program crash
PID:1232
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4480 -ip 44801⤵PID:432