Analysis
-
max time kernel
52s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2022 17:40
Static task
static1
Behavioral task
behavioral1
Sample
f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe
-
Size
954KB
-
MD5
b185673af8f2c81a6c2f3e11ca996bfe
-
SHA1
b386cb9354d3ffc83aa043ded22b7452c9b423c0
-
SHA256
f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf
-
SHA512
8d1c822cc72f55bd163c11f1eabab4a6a1995f81fc9cc3a47f4cf0b1288a266ee72907677d2b927f4877bfe3ac383a898e9523066cc640c8c39b0b0f04b68425
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe" f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 456 4876 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2448 schtasks.exe 4984 schtasks.exe 484 schtasks.exe 524 schtasks.exe 3740 schtasks.exe 4416 schtasks.exe 3808 schtasks.exe 4792 schtasks.exe 2032 schtasks.exe 4440 schtasks.exe 4444 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 5020 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 83 PID 4876 wrote to memory of 5020 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 83 PID 4876 wrote to memory of 5020 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 83 PID 4876 wrote to memory of 664 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 84 PID 4876 wrote to memory of 664 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 84 PID 4876 wrote to memory of 664 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 84 PID 4876 wrote to memory of 4972 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 87 PID 4876 wrote to memory of 4972 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 87 PID 4876 wrote to memory of 4972 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 87 PID 4876 wrote to memory of 5004 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 89 PID 4876 wrote to memory of 5004 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 89 PID 4876 wrote to memory of 5004 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 89 PID 4876 wrote to memory of 1260 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 91 PID 4876 wrote to memory of 1260 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 91 PID 4876 wrote to memory of 1260 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 91 PID 4876 wrote to memory of 1488 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 95 PID 4876 wrote to memory of 1488 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 95 PID 4876 wrote to memory of 1488 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 95 PID 4876 wrote to memory of 1156 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 94 PID 4876 wrote to memory of 1156 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 94 PID 4876 wrote to memory of 1156 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 94 PID 4876 wrote to memory of 4228 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 96 PID 4876 wrote to memory of 4228 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 96 PID 4876 wrote to memory of 4228 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 96 PID 4876 wrote to memory of 1116 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 97 PID 4876 wrote to memory of 1116 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 97 PID 4876 wrote to memory of 1116 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 97 PID 4876 wrote to memory of 1772 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 98 PID 4876 wrote to memory of 1772 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 98 PID 4876 wrote to memory of 1772 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 98 PID 4876 wrote to memory of 1676 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 99 PID 4876 wrote to memory of 1676 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 99 PID 4876 wrote to memory of 1676 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 99 PID 4876 wrote to memory of 3472 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 102 PID 4876 wrote to memory of 3472 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 102 PID 4876 wrote to memory of 3472 4876 f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe 102 PID 4228 wrote to memory of 4444 4228 cmd.exe 117 PID 4228 wrote to memory of 4444 4228 cmd.exe 117 PID 4228 wrote to memory of 4444 4228 cmd.exe 117 PID 5004 wrote to memory of 4440 5004 cmd.exe 116 PID 5004 wrote to memory of 4440 5004 cmd.exe 116 PID 5004 wrote to memory of 4440 5004 cmd.exe 116 PID 1488 wrote to memory of 3740 1488 cmd.exe 108 PID 1488 wrote to memory of 3740 1488 cmd.exe 108 PID 1488 wrote to memory of 3740 1488 cmd.exe 108 PID 1156 wrote to memory of 524 1156 cmd.exe 107 PID 1156 wrote to memory of 524 1156 cmd.exe 107 PID 1156 wrote to memory of 524 1156 cmd.exe 107 PID 664 wrote to memory of 4416 664 cmd.exe 109 PID 664 wrote to memory of 4416 664 cmd.exe 109 PID 664 wrote to memory of 4416 664 cmd.exe 109 PID 1116 wrote to memory of 2032 1116 cmd.exe 115 PID 1116 wrote to memory of 2032 1116 cmd.exe 115 PID 1116 wrote to memory of 2032 1116 cmd.exe 115 PID 4972 wrote to memory of 4792 4972 cmd.exe 114 PID 4972 wrote to memory of 4792 4972 cmd.exe 114 PID 4972 wrote to memory of 4792 4972 cmd.exe 114 PID 1676 wrote to memory of 4984 1676 cmd.exe 111 PID 1676 wrote to memory of 4984 1676 cmd.exe 111 PID 1676 wrote to memory of 4984 1676 cmd.exe 111 PID 3472 wrote to memory of 2448 3472 cmd.exe 110 PID 3472 wrote to memory of 2448 3472 cmd.exe 110 PID 3472 wrote to memory of 2448 3472 cmd.exe 110 PID 1260 wrote to memory of 3808 1260 cmd.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵PID:5020
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:484
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:4416
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:4792
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:4440
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:3808
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:524
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:3740
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:4444
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7219" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7219" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:2032
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9008" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵PID:1772
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1698" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1698" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:4984
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1043" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1043" /TR "C:\Users\Admin\AppData\Local\Temp\f436687ca5cc0b428251275bc760987e2edaccfdbace57c816f48ee1732cdecf.exe"3⤵
- Creates scheduled task(s)
PID:2448
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 10402⤵
- Program crash
PID:456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4876 -ip 48761⤵PID:4492