Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2023 16:40
Static task
static1
General
-
Target
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe
-
Size
795KB
-
MD5
102dfca73df9a539a34b886349365381
-
SHA1
35b90a9ae3dc136502102017c0488c5fc028eae1
-
SHA256
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9
-
SHA512
4335a75a836ebb5c9f589d36bd9b96fa6c3c751ff37caf23805317cdd5082fef0fb3ed198ebdb90cde6e9700d4b0ede2233b6bab8cb421d193c1099510733316
-
SSDEEP
12288:Q84kSMdr3GNUAn9cNNeX8X/iTS46omh7lZyxa6A0KG384C26ygrxNU4Jpth9+8PZ:Q8fUc6ApGLC7ysxD1d/4e
Malware Config
Extracted
xpertrat
3.0.10
STRIGIO
sandshoe.myfirewall.org:5344
I8N3F0X7-G4E2-P2S0-T0D7-R1N2H5T660I4
Signatures
-
Processes:
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe -
Processes:
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe -
XpertRAT Core payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1528-19-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat -
Processes:
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe -
Processes:
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe -
Program crash 37 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3432 1528 WerFault.exe iexplore.exe 4780 684 WerFault.exe iexplore.exe 4792 3588 WerFault.exe iexplore.exe 1120 1532 WerFault.exe iexplore.exe 1708 4844 WerFault.exe iexplore.exe 4384 748 WerFault.exe iexplore.exe 4176 4192 WerFault.exe iexplore.exe 1124 2060 WerFault.exe iexplore.exe 1400 4968 WerFault.exe iexplore.exe 2836 1868 WerFault.exe iexplore.exe 388 3664 WerFault.exe iexplore.exe 3172 4240 WerFault.exe iexplore.exe 1904 3472 WerFault.exe iexplore.exe 3700 3960 WerFault.exe iexplore.exe 4260 2108 WerFault.exe iexplore.exe 4404 4848 WerFault.exe iexplore.exe 4352 4864 WerFault.exe iexplore.exe 4256 4576 WerFault.exe iexplore.exe 1268 3244 WerFault.exe iexplore.exe 4588 4632 WerFault.exe iexplore.exe 2992 2344 WerFault.exe iexplore.exe 4532 4372 WerFault.exe iexplore.exe 3520 4340 WerFault.exe iexplore.exe 1828 3108 WerFault.exe iexplore.exe 4504 1160 WerFault.exe iexplore.exe 1804 1892 WerFault.exe iexplore.exe 2764 3908 WerFault.exe iexplore.exe 116 1476 WerFault.exe iexplore.exe 1556 400 WerFault.exe iexplore.exe 3824 1548 WerFault.exe iexplore.exe 1692 2548 WerFault.exe iexplore.exe 4148 728 WerFault.exe iexplore.exe 468 4984 WerFault.exe iexplore.exe 3880 1020 WerFault.exe iexplore.exe 3388 3576 WerFault.exe iexplore.exe 4744 4324 WerFault.exe iexplore.exe 2868 4772 WerFault.exe iexplore.exe -
Suspicious use of SetThreadContext 38 IoCs
Processes:
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exedescription pid process target process PID 1012 set thread context of 3952 1012 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe PID 3952 set thread context of 1528 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 684 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 3588 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 1532 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4844 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 748 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4192 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 2060 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4968 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 1868 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 3664 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4240 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 3472 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 3960 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 2108 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4848 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4864 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4576 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 3244 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4632 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 2344 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4372 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4340 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 3108 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 1160 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 1892 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 3908 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 1476 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 400 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 1548 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 2548 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 728 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4984 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 1020 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 3576 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4324 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 set thread context of 4772 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exepid process 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exepid process 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 1532 iexplore.exe 1020 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exedescription pid process target process PID 1012 wrote to memory of 3952 1012 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe PID 1012 wrote to memory of 3952 1012 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe PID 1012 wrote to memory of 3952 1012 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe PID 1012 wrote to memory of 3952 1012 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe PID 1012 wrote to memory of 3952 1012 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe PID 1012 wrote to memory of 3952 1012 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe PID 1012 wrote to memory of 3952 1012 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe PID 3952 wrote to memory of 1528 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1528 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1528 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1528 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1528 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1528 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1528 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1528 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 684 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 684 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 684 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 684 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 684 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 684 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 684 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 684 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 3588 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 3588 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 3588 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 3588 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 3588 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 3588 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 3588 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 3588 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1532 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1532 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1532 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1532 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1532 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1532 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1532 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 1532 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4844 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4844 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4844 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4844 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4844 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4844 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4844 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4844 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 748 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 748 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 748 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 748 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 748 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 748 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 748 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 748 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4192 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4192 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4192 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4192 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4192 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4192 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4192 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 4192 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe PID 3952 wrote to memory of 2060 3952 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe"C:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe"C:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe"2⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 124⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\27216219fbe93818c217c05b66b6586ab58bb000b1c9bc96da93561923f1fce9.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1528 -ip 15281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 684 -ip 6841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3588 -ip 35881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1532 -ip 15321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4844 -ip 48441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 748 -ip 7481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4192 -ip 41921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2060 -ip 20601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4968 -ip 49681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1868 -ip 18681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3664 -ip 36641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4240 -ip 42401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3472 -ip 34721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3960 -ip 39601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2108 -ip 21081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4848 -ip 48481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4864 -ip 48641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4576 -ip 45761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3244 -ip 32441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4632 -ip 46321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2344 -ip 23441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4372 -ip 43721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4340 -ip 43401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3108 -ip 31081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1892 -ip 18921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3908 -ip 39081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1476 -ip 14761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1548 -ip 15481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2548 -ip 25481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 728 -ip 7281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4984 -ip 49841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1020 -ip 10201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3576 -ip 35761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4324 -ip 43241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4772 -ip 47721⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1012-8-0x0000000005830000-0x0000000005840000-memory.dmpFilesize
64KB
-
memory/1012-4-0x0000000005830000-0x0000000005840000-memory.dmpFilesize
64KB
-
memory/1012-0-0x0000000074670000-0x0000000074E20000-memory.dmpFilesize
7.7MB
-
memory/1012-3-0x0000000005890000-0x0000000005922000-memory.dmpFilesize
584KB
-
memory/1012-9-0x0000000005D90000-0x0000000005D9A000-memory.dmpFilesize
40KB
-
memory/1012-5-0x0000000005A40000-0x0000000005A4A000-memory.dmpFilesize
40KB
-
memory/1012-6-0x0000000005D70000-0x0000000005D88000-memory.dmpFilesize
96KB
-
memory/1012-10-0x000000000AF00000-0x000000000AF6C000-memory.dmpFilesize
432KB
-
memory/1012-2-0x0000000005DA0000-0x0000000006344000-memory.dmpFilesize
5.6MB
-
memory/1012-1-0x0000000000DD0000-0x0000000000E9C000-memory.dmpFilesize
816KB
-
memory/1012-7-0x0000000074670000-0x0000000074E20000-memory.dmpFilesize
7.7MB
-
memory/1012-11-0x000000000CF70000-0x000000000D00C000-memory.dmpFilesize
624KB
-
memory/1012-16-0x0000000074670000-0x0000000074E20000-memory.dmpFilesize
7.7MB
-
memory/1528-19-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/3952-15-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3952-12-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3952-23-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB