Analysis
-
max time kernel
90s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/10/2022, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe
-
Size
957KB
-
MD5
ad16e79280d7fe5db49e3fb6ad9396f6
-
SHA1
bfc013429eca939d3f566e8383930d4bda3cf0be
-
SHA256
d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3
-
SHA512
9db53fe1c0f5d5ee7746cda9123f1036fa09a0a311412cf37e5cad918d962d9ce698570cbe28aa0567ada44187777a847bc02ec812c2e25f5e9c4f763bf48d5d
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe" d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3112 1568 WerFault.exe 79 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 320 schtasks.exe 4164 schtasks.exe 4284 schtasks.exe 3184 schtasks.exe 2388 schtasks.exe 2308 schtasks.exe 4548 schtasks.exe 212 schtasks.exe 116 schtasks.exe 872 schtasks.exe 2304 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1568 wrote to memory of 1960 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 80 PID 1568 wrote to memory of 1960 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 80 PID 1568 wrote to memory of 1960 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 80 PID 1568 wrote to memory of 2084 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 81 PID 1568 wrote to memory of 2084 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 81 PID 1568 wrote to memory of 2084 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 81 PID 1568 wrote to memory of 3932 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 103 PID 1568 wrote to memory of 3932 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 103 PID 1568 wrote to memory of 3932 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 103 PID 1568 wrote to memory of 4436 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 84 PID 1568 wrote to memory of 4436 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 84 PID 1568 wrote to memory of 4436 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 84 PID 1568 wrote to memory of 4804 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 85 PID 1568 wrote to memory of 4804 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 85 PID 1568 wrote to memory of 4804 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 85 PID 1568 wrote to memory of 4764 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 100 PID 1568 wrote to memory of 4764 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 100 PID 1568 wrote to memory of 4764 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 100 PID 1568 wrote to memory of 4684 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 86 PID 1568 wrote to memory of 4684 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 86 PID 1568 wrote to memory of 4684 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 86 PID 1568 wrote to memory of 1112 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 87 PID 1568 wrote to memory of 1112 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 87 PID 1568 wrote to memory of 1112 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 87 PID 1568 wrote to memory of 4160 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 96 PID 1568 wrote to memory of 4160 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 96 PID 1568 wrote to memory of 4160 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 96 PID 1568 wrote to memory of 4520 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 95 PID 1568 wrote to memory of 4520 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 95 PID 1568 wrote to memory of 4520 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 95 PID 1568 wrote to memory of 2080 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 93 PID 1568 wrote to memory of 2080 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 93 PID 1568 wrote to memory of 2080 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 93 PID 1568 wrote to memory of 4088 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 90 PID 1568 wrote to memory of 4088 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 90 PID 1568 wrote to memory of 4088 1568 d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe 90 PID 4520 wrote to memory of 4164 4520 cmd.exe 107 PID 4520 wrote to memory of 4164 4520 cmd.exe 107 PID 4520 wrote to memory of 4164 4520 cmd.exe 107 PID 4684 wrote to memory of 872 4684 cmd.exe 106 PID 4684 wrote to memory of 872 4684 cmd.exe 106 PID 4684 wrote to memory of 872 4684 cmd.exe 106 PID 4160 wrote to memory of 116 4160 cmd.exe 105 PID 4160 wrote to memory of 116 4160 cmd.exe 105 PID 4160 wrote to memory of 116 4160 cmd.exe 105 PID 2080 wrote to memory of 212 2080 cmd.exe 104 PID 2080 wrote to memory of 212 2080 cmd.exe 104 PID 2080 wrote to memory of 212 2080 cmd.exe 104 PID 2084 wrote to memory of 320 2084 cmd.exe 114 PID 2084 wrote to memory of 320 2084 cmd.exe 114 PID 2084 wrote to memory of 320 2084 cmd.exe 114 PID 4088 wrote to memory of 4548 4088 cmd.exe 113 PID 4088 wrote to memory of 4548 4088 cmd.exe 113 PID 4088 wrote to memory of 4548 4088 cmd.exe 113 PID 3932 wrote to memory of 2304 3932 cmd.exe 112 PID 3932 wrote to memory of 2304 3932 cmd.exe 112 PID 3932 wrote to memory of 2304 3932 cmd.exe 112 PID 4764 wrote to memory of 2308 4764 cmd.exe 111 PID 4764 wrote to memory of 2308 4764 cmd.exe 111 PID 4764 wrote to memory of 2308 4764 cmd.exe 111 PID 4436 wrote to memory of 2388 4436 cmd.exe 110 PID 4436 wrote to memory of 2388 4436 cmd.exe 110 PID 4436 wrote to memory of 2388 4436 cmd.exe 110 PID 1112 wrote to memory of 3184 1112 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵PID:1960
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:320
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:2388
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵PID:4804
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:4284
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:872
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:3184
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8805" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8805" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:4548
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8924" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8924" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:212
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8745" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8745" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:4164
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk162" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk162" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:116
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:2308
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\d87867a5a17f75f00dd4ef92b914f4fa6f7c29a337544d9c9d9dd10832805af3.exe"3⤵
- Creates scheduled task(s)
PID:2304
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 14282⤵
- Program crash
PID:3112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1568 -ip 15681⤵PID:2072