Analysis
-
max time kernel
70s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2022 05:56
Static task
static1
Behavioral task
behavioral1
Sample
a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe
-
Size
966KB
-
MD5
c17af7b3dff1047a5fe7f398420b3ae2
-
SHA1
bce929f79dec1fef489ae15d77beef2fd9a7670c
-
SHA256
a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a
-
SHA512
6ce1af90b99b6b333739655b9b56f24e07fef51e25dda727eb395efb99b3761cfaeea807a1fed746c1a7aa6bed6c2040ac73930ed5ad244c93029d0186f2220d
-
SSDEEP
768:5RdutBr/u3GduUrRTj8ObyVUBMfSDFTh0lrpcxNq3ey16HMV1Iu3MCBo6qstNpzJ:5R4HmK3Tj8J4FPHMV1tNRLbwCX
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe" a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2432 4824 WerFault.exe 80 -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5028 schtasks.exe 3416 schtasks.exe 1892 schtasks.exe 5092 schtasks.exe 2232 schtasks.exe 1652 schtasks.exe 4536 schtasks.exe 4404 schtasks.exe 2200 schtasks.exe 2308 schtasks.exe 3760 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4824 wrote to memory of 1644 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 82 PID 4824 wrote to memory of 1644 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 82 PID 4824 wrote to memory of 1644 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 82 PID 4824 wrote to memory of 1240 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 83 PID 4824 wrote to memory of 1240 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 83 PID 4824 wrote to memory of 1240 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 83 PID 4824 wrote to memory of 2296 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 84 PID 4824 wrote to memory of 2296 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 84 PID 4824 wrote to memory of 2296 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 84 PID 4824 wrote to memory of 368 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 85 PID 4824 wrote to memory of 368 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 85 PID 4824 wrote to memory of 368 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 85 PID 4824 wrote to memory of 4436 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 104 PID 4824 wrote to memory of 4436 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 104 PID 4824 wrote to memory of 4436 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 104 PID 4824 wrote to memory of 1496 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 87 PID 4824 wrote to memory of 1496 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 87 PID 4824 wrote to memory of 1496 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 87 PID 4824 wrote to memory of 2368 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 89 PID 4824 wrote to memory of 2368 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 89 PID 4824 wrote to memory of 2368 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 89 PID 4824 wrote to memory of 204 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 100 PID 4824 wrote to memory of 204 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 100 PID 4824 wrote to memory of 204 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 100 PID 4824 wrote to memory of 1176 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 99 PID 4824 wrote to memory of 1176 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 99 PID 4824 wrote to memory of 1176 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 99 PID 1644 wrote to memory of 2200 1644 cmd.exe 98 PID 1644 wrote to memory of 2200 1644 cmd.exe 98 PID 1644 wrote to memory of 2200 1644 cmd.exe 98 PID 4824 wrote to memory of 1936 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 97 PID 4824 wrote to memory of 1936 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 97 PID 4824 wrote to memory of 1936 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 97 PID 4824 wrote to memory of 804 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 94 PID 4824 wrote to memory of 804 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 94 PID 4824 wrote to memory of 804 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 94 PID 4824 wrote to memory of 3396 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 95 PID 4824 wrote to memory of 3396 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 95 PID 4824 wrote to memory of 3396 4824 a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe 95 PID 204 wrote to memory of 2308 204 cmd.exe 107 PID 204 wrote to memory of 2308 204 cmd.exe 107 PID 204 wrote to memory of 2308 204 cmd.exe 107 PID 2296 wrote to memory of 2232 2296 cmd.exe 108 PID 2296 wrote to memory of 2232 2296 cmd.exe 108 PID 2296 wrote to memory of 2232 2296 cmd.exe 108 PID 368 wrote to memory of 5028 368 cmd.exe 112 PID 368 wrote to memory of 5028 368 cmd.exe 112 PID 368 wrote to memory of 5028 368 cmd.exe 112 PID 1496 wrote to memory of 1652 1496 cmd.exe 109 PID 1496 wrote to memory of 1652 1496 cmd.exe 109 PID 1496 wrote to memory of 1652 1496 cmd.exe 109 PID 4436 wrote to memory of 4536 4436 cmd.exe 110 PID 4436 wrote to memory of 4536 4436 cmd.exe 110 PID 4436 wrote to memory of 4536 4436 cmd.exe 110 PID 1240 wrote to memory of 3760 1240 cmd.exe 111 PID 1240 wrote to memory of 3760 1240 cmd.exe 111 PID 1240 wrote to memory of 3760 1240 cmd.exe 111 PID 2368 wrote to memory of 3416 2368 cmd.exe 113 PID 2368 wrote to memory of 3416 2368 cmd.exe 113 PID 2368 wrote to memory of 3416 2368 cmd.exe 113 PID 1936 wrote to memory of 4404 1936 cmd.exe 115 PID 1936 wrote to memory of 4404 1936 cmd.exe 115 PID 1936 wrote to memory of 4404 1936 cmd.exe 115 PID 3396 wrote to memory of 1892 3396 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:2200
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:3760
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:2232
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:5028
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:1652
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:3416
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6378" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵PID:804
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6378" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:5092
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5342" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5342" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:1892
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3460" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3460" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:4404
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6972" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵PID:1176
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:2308
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\Users\Admin\AppData\Local\Temp\a9c3cd50f587205c5986316076ce97ed044f8a727667ff8c6d42e63103d7124a.exe"3⤵
- Creates scheduled task(s)
PID:4536
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 13762⤵
- Program crash
PID:2432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4824 -ip 48241⤵PID:4524