Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2022, 12:13
Static task
static1
Behavioral task
behavioral1
Sample
05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe
-
Size
959KB
-
MD5
9471d7350294230fcbe716f9c31986ac
-
SHA1
1ceb53ab3d65fada161935022b88d8e9ff5b2fd0
-
SHA256
05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c
-
SHA512
33b8baafe3926b5a6367e21ffb7bae74a48d83660149a6218dfc9bcedfadf8b7a7d92711f0f97b48dd6dad835726726caa8be06dcb5c5c02c2ca7bdf08c6b0be
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe" 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1596 2728 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4672 schtasks.exe 4472 schtasks.exe 2480 schtasks.exe 4280 schtasks.exe 3556 schtasks.exe 5108 schtasks.exe 1648 schtasks.exe 4340 schtasks.exe 2668 schtasks.exe 4568 schtasks.exe 3312 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2380 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 83 PID 2728 wrote to memory of 2380 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 83 PID 2728 wrote to memory of 2380 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 83 PID 2728 wrote to memory of 2224 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 84 PID 2728 wrote to memory of 2224 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 84 PID 2728 wrote to memory of 2224 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 84 PID 2728 wrote to memory of 4180 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 105 PID 2728 wrote to memory of 4180 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 105 PID 2728 wrote to memory of 4180 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 105 PID 2728 wrote to memory of 2580 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 86 PID 2728 wrote to memory of 2580 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 86 PID 2728 wrote to memory of 2580 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 86 PID 2728 wrote to memory of 2192 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 87 PID 2728 wrote to memory of 2192 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 87 PID 2728 wrote to memory of 2192 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 87 PID 2728 wrote to memory of 2212 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 101 PID 2728 wrote to memory of 2212 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 101 PID 2728 wrote to memory of 2212 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 101 PID 2728 wrote to memory of 256 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 88 PID 2728 wrote to memory of 256 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 88 PID 2728 wrote to memory of 256 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 88 PID 2728 wrote to memory of 116 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 99 PID 2728 wrote to memory of 116 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 99 PID 2728 wrote to memory of 116 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 99 PID 2728 wrote to memory of 684 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 91 PID 2728 wrote to memory of 684 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 91 PID 2728 wrote to memory of 684 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 91 PID 2380 wrote to memory of 1648 2380 cmd.exe 98 PID 2380 wrote to memory of 1648 2380 cmd.exe 98 PID 2380 wrote to memory of 1648 2380 cmd.exe 98 PID 2728 wrote to memory of 3508 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 92 PID 2728 wrote to memory of 3508 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 92 PID 2728 wrote to memory of 3508 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 92 PID 2728 wrote to memory of 3728 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 94 PID 2728 wrote to memory of 3728 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 94 PID 2728 wrote to memory of 3728 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 94 PID 2728 wrote to memory of 1944 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 95 PID 2728 wrote to memory of 1944 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 95 PID 2728 wrote to memory of 1944 2728 05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe 95 PID 684 wrote to memory of 4340 684 cmd.exe 108 PID 684 wrote to memory of 4340 684 cmd.exe 108 PID 684 wrote to memory of 4340 684 cmd.exe 108 PID 3508 wrote to memory of 4568 3508 cmd.exe 109 PID 3508 wrote to memory of 4568 3508 cmd.exe 109 PID 3508 wrote to memory of 4568 3508 cmd.exe 109 PID 2224 wrote to memory of 4280 2224 cmd.exe 114 PID 2224 wrote to memory of 4280 2224 cmd.exe 114 PID 2224 wrote to memory of 4280 2224 cmd.exe 114 PID 4180 wrote to memory of 4672 4180 cmd.exe 110 PID 4180 wrote to memory of 4672 4180 cmd.exe 110 PID 4180 wrote to memory of 4672 4180 cmd.exe 110 PID 2580 wrote to memory of 4472 2580 cmd.exe 111 PID 2580 wrote to memory of 4472 2580 cmd.exe 111 PID 2580 wrote to memory of 4472 2580 cmd.exe 111 PID 2192 wrote to memory of 3312 2192 cmd.exe 113 PID 2192 wrote to memory of 3312 2192 cmd.exe 113 PID 2192 wrote to memory of 3312 2192 cmd.exe 113 PID 256 wrote to memory of 2480 256 cmd.exe 112 PID 256 wrote to memory of 2480 256 cmd.exe 112 PID 256 wrote to memory of 2480 256 cmd.exe 112 PID 116 wrote to memory of 5108 116 cmd.exe 116 PID 116 wrote to memory of 5108 116 cmd.exe 116 PID 116 wrote to memory of 5108 116 cmd.exe 116 PID 2212 wrote to memory of 3556 2212 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:1648
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:4280
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:4472
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:3312
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:2480
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4460" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4460" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:4340
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6449" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk6449" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:4568
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk2059" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵PID:3728
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7755" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵PID:1944
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7755" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:2668
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:5108
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:3556
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\05b2f3e08250a98f1733d63217b305f49133d79b02f1dfb7ed333894ea78aa6c.exe"3⤵
- Creates scheduled task(s)
PID:4672
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 13642⤵
- Program crash
PID:1596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2728 -ip 27281⤵PID:2252