Analysis
-
max time kernel
61s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2022 10:26
Static task
static1
Behavioral task
behavioral1
Sample
3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe
-
Size
962KB
-
MD5
bc158e8619d6b735ae92d70f7e94e6a0
-
SHA1
2b62cdc9d21941b532c41c8cbfd88adaf4cc410d
-
SHA256
3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636
-
SHA512
aa37cb1ab5653c1a5c65caf195951b1018a60e01854aad5012162ae74b33cfad07a1fbe8a053d1bca144fe2622776a93a55d9e40114c1917fab8a107eebf2b68
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe" 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2984 2284 WerFault.exe 82 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2676 schtasks.exe 1728 schtasks.exe 3492 schtasks.exe 1048 schtasks.exe 3668 schtasks.exe 116 schtasks.exe 1304 schtasks.exe 348 schtasks.exe 3676 schtasks.exe 4420 schtasks.exe 1116 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 4212 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 83 PID 2284 wrote to memory of 4212 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 83 PID 2284 wrote to memory of 4212 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 83 PID 2284 wrote to memory of 3288 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 84 PID 2284 wrote to memory of 3288 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 84 PID 2284 wrote to memory of 3288 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 84 PID 2284 wrote to memory of 2140 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 90 PID 2284 wrote to memory of 2140 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 90 PID 2284 wrote to memory of 2140 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 90 PID 2284 wrote to memory of 2688 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 86 PID 2284 wrote to memory of 2688 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 86 PID 2284 wrote to memory of 2688 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 86 PID 2284 wrote to memory of 4880 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 87 PID 2284 wrote to memory of 4880 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 87 PID 2284 wrote to memory of 4880 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 87 PID 2284 wrote to memory of 4844 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 91 PID 2284 wrote to memory of 4844 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 91 PID 2284 wrote to memory of 4844 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 91 PID 2284 wrote to memory of 4820 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 93 PID 2284 wrote to memory of 4820 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 93 PID 2284 wrote to memory of 4820 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 93 PID 2284 wrote to memory of 5072 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 94 PID 2284 wrote to memory of 5072 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 94 PID 2284 wrote to memory of 5072 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 94 PID 2284 wrote to memory of 4476 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 95 PID 2284 wrote to memory of 4476 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 95 PID 2284 wrote to memory of 4476 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 95 PID 2284 wrote to memory of 4840 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 99 PID 2284 wrote to memory of 4840 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 99 PID 2284 wrote to memory of 4840 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 99 PID 2284 wrote to memory of 1764 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 100 PID 2284 wrote to memory of 1764 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 100 PID 2284 wrote to memory of 1764 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 100 PID 2284 wrote to memory of 64 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 101 PID 2284 wrote to memory of 64 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 101 PID 2284 wrote to memory of 64 2284 3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe 101 PID 3288 wrote to memory of 1116 3288 cmd.exe 104 PID 3288 wrote to memory of 1116 3288 cmd.exe 104 PID 3288 wrote to memory of 1116 3288 cmd.exe 104 PID 2140 wrote to memory of 116 2140 cmd.exe 108 PID 2140 wrote to memory of 116 2140 cmd.exe 108 PID 2140 wrote to memory of 116 2140 cmd.exe 108 PID 4212 wrote to memory of 348 4212 cmd.exe 110 PID 4212 wrote to memory of 348 4212 cmd.exe 110 PID 4212 wrote to memory of 348 4212 cmd.exe 110 PID 2688 wrote to memory of 1304 2688 cmd.exe 109 PID 2688 wrote to memory of 1304 2688 cmd.exe 109 PID 2688 wrote to memory of 1304 2688 cmd.exe 109 PID 4880 wrote to memory of 2676 4880 cmd.exe 111 PID 4880 wrote to memory of 2676 4880 cmd.exe 111 PID 4880 wrote to memory of 2676 4880 cmd.exe 111 PID 5072 wrote to memory of 4420 5072 cmd.exe 116 PID 5072 wrote to memory of 4420 5072 cmd.exe 116 PID 5072 wrote to memory of 4420 5072 cmd.exe 116 PID 4844 wrote to memory of 1728 4844 cmd.exe 112 PID 4844 wrote to memory of 1728 4844 cmd.exe 112 PID 4844 wrote to memory of 1728 4844 cmd.exe 112 PID 4820 wrote to memory of 1048 4820 cmd.exe 115 PID 4820 wrote to memory of 1048 4820 cmd.exe 115 PID 4820 wrote to memory of 1048 4820 cmd.exe 115 PID 4840 wrote to memory of 3492 4840 cmd.exe 113 PID 4840 wrote to memory of 3492 4840 cmd.exe 113 PID 4840 wrote to memory of 3492 4840 cmd.exe 113 PID 4476 wrote to memory of 3676 4476 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:348
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:1116
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:1304
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:2676
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:116
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:1728
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:1048
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:4420
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1895" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1895" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:3676
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk54" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk54" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:3492
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4102" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵PID:1764
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9404" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"2⤵PID:64
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9404" /TR "C:\Users\Admin\AppData\Local\Temp\3e717338f449c01d4ddae38077366b8873b2147fbd4ab0741d8c727bba8ed636.exe"3⤵
- Creates scheduled task(s)
PID:3668
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 13682⤵
- Program crash
PID:2984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2284 -ip 22841⤵PID:2104