Analysis
-
max time kernel
82s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2022, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe
-
Size
959KB
-
MD5
e9881d550e93e13bc07e4272b5120ac3
-
SHA1
8e22f590b4c0e834ba0828104362eeb663361f9c
-
SHA256
3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f
-
SHA512
e71deb3e4a8daa812d511e1d17dc89b7115b03a622b0db280fb493c23e695fae15693a3577c83341fa8e28c6ded6e6437b341bef7b98a46b43fc09c32fadb160
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe" 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2144 4016 WerFault.exe 81 -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2284 schtasks.exe 376 schtasks.exe 4496 schtasks.exe 5004 schtasks.exe 4984 schtasks.exe 4140 schtasks.exe 3740 schtasks.exe 3268 schtasks.exe 3836 schtasks.exe 4176 schtasks.exe 5088 schtasks.exe 1484 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4016 wrote to memory of 4868 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 84 PID 4016 wrote to memory of 4868 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 84 PID 4016 wrote to memory of 4868 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 84 PID 4016 wrote to memory of 4752 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 83 PID 4016 wrote to memory of 4752 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 83 PID 4016 wrote to memory of 4752 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 83 PID 4016 wrote to memory of 3084 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 98 PID 4016 wrote to memory of 3084 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 98 PID 4016 wrote to memory of 3084 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 98 PID 4016 wrote to memory of 1060 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 96 PID 4016 wrote to memory of 1060 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 96 PID 4016 wrote to memory of 1060 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 96 PID 4016 wrote to memory of 3384 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 94 PID 4016 wrote to memory of 3384 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 94 PID 4016 wrote to memory of 3384 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 94 PID 4016 wrote to memory of 4220 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 86 PID 4016 wrote to memory of 4220 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 86 PID 4016 wrote to memory of 4220 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 86 PID 4016 wrote to memory of 3064 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 88 PID 4016 wrote to memory of 3064 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 88 PID 4016 wrote to memory of 3064 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 88 PID 4868 wrote to memory of 2284 4868 cmd.exe 93 PID 4868 wrote to memory of 2284 4868 cmd.exe 93 PID 4868 wrote to memory of 2284 4868 cmd.exe 93 PID 4016 wrote to memory of 1464 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 92 PID 4016 wrote to memory of 1464 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 92 PID 4016 wrote to memory of 1464 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 92 PID 4016 wrote to memory of 2880 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 103 PID 4016 wrote to memory of 2880 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 103 PID 4016 wrote to memory of 2880 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 103 PID 4016 wrote to memory of 1456 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 99 PID 4016 wrote to memory of 1456 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 99 PID 4016 wrote to memory of 1456 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 99 PID 4016 wrote to memory of 32 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 100 PID 4016 wrote to memory of 32 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 100 PID 4016 wrote to memory of 32 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 100 PID 4016 wrote to memory of 644 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 104 PID 4016 wrote to memory of 644 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 104 PID 4016 wrote to memory of 644 4016 3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe 104 PID 1464 wrote to memory of 3740 1464 cmd.exe 107 PID 1464 wrote to memory of 3740 1464 cmd.exe 107 PID 1464 wrote to memory of 3740 1464 cmd.exe 107 PID 4752 wrote to memory of 4176 4752 cmd.exe 115 PID 4752 wrote to memory of 4176 4752 cmd.exe 115 PID 4752 wrote to memory of 4176 4752 cmd.exe 115 PID 3084 wrote to memory of 376 3084 cmd.exe 109 PID 3084 wrote to memory of 376 3084 cmd.exe 109 PID 3084 wrote to memory of 376 3084 cmd.exe 109 PID 3064 wrote to memory of 4984 3064 cmd.exe 114 PID 3064 wrote to memory of 4984 3064 cmd.exe 114 PID 3064 wrote to memory of 4984 3064 cmd.exe 114 PID 3384 wrote to memory of 5004 3384 cmd.exe 113 PID 3384 wrote to memory of 5004 3384 cmd.exe 113 PID 3384 wrote to memory of 5004 3384 cmd.exe 113 PID 2880 wrote to memory of 3268 2880 cmd.exe 110 PID 2880 wrote to memory of 3268 2880 cmd.exe 110 PID 2880 wrote to memory of 3268 2880 cmd.exe 110 PID 1060 wrote to memory of 4496 1060 cmd.exe 111 PID 1060 wrote to memory of 4496 1060 cmd.exe 111 PID 1060 wrote to memory of 4496 1060 cmd.exe 111 PID 4220 wrote to memory of 3836 4220 cmd.exe 112 PID 4220 wrote to memory of 3836 4220 cmd.exe 112 PID 4220 wrote to memory of 3836 4220 cmd.exe 112 PID 644 wrote to memory of 5088 644 cmd.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:4176
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:2284
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:3836
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:4984
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:3740
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:5004
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:4496
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:376
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8777" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵PID:1456
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8777" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:1484
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2093" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵PID:32
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2093" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:4140
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9957" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9957" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:3268
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk588" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk588" /TR "C:\Users\Admin\AppData\Local\Temp\3c728e72c1b0c5d0edd47901ba8c707854afce58e19ca6758203bf3715a8d96f.exe"3⤵
- Creates scheduled task(s)
PID:5088
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 10402⤵
- Program crash
PID:2144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4016 -ip 40161⤵PID:3452