Analysis
-
max time kernel
137s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:02
Behavioral task
behavioral1
Sample
74ec501d9a7139f93d33aa4046ceb2ee.exe
Resource
win7-20231215-en
General
-
Target
74ec501d9a7139f93d33aa4046ceb2ee.exe
-
Size
501KB
-
MD5
74ec501d9a7139f93d33aa4046ceb2ee
-
SHA1
b5615dbe614144c9e7f4afcffddcd198a866fd29
-
SHA256
c0a3732331a23a990081a68f1e3dca0b84cbcbfe34bd8d6ca0bd2848b44cc029
-
SHA512
f7a15ca9a097e0b14d2e99219f8750b7c4174bb2df9ade1eecd7c4ba1b3df1db4ae7c5e5d5a55e50fc19e49fa1f7446749afd403d3127e120fafdd918043565a
-
SSDEEP
12288:EgSPfwpRFZ4WSmB+749mTsSsOOvM8pqISf:mPfyRFZ4KpsaO6M8y
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
74ec501d9a7139f93d33aa4046ceb2ee.exepid process 2948 74ec501d9a7139f93d33aa4046ceb2ee.exe -
Executes dropped EXE 1 IoCs
Processes:
74ec501d9a7139f93d33aa4046ceb2ee.exepid process 2948 74ec501d9a7139f93d33aa4046ceb2ee.exe -
Processes:
resource yara_rule behavioral2/memory/1620-0-0x0000000000400000-0x000000000065C000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\74ec501d9a7139f93d33aa4046ceb2ee.exe upx behavioral2/memory/2948-14-0x0000000000400000-0x000000000065C000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Program crash 18 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4024 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 488 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 3872 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 3932 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 3756 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 3160 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 1756 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 1476 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 3312 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 496 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 3732 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 3256 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 1204 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 1976 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 4908 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 2192 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 4332 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe 2052 2948 WerFault.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
74ec501d9a7139f93d33aa4046ceb2ee.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 74ec501d9a7139f93d33aa4046ceb2ee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 74ec501d9a7139f93d33aa4046ceb2ee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 74ec501d9a7139f93d33aa4046ceb2ee.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 74ec501d9a7139f93d33aa4046ceb2ee.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 74ec501d9a7139f93d33aa4046ceb2ee.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
74ec501d9a7139f93d33aa4046ceb2ee.exepid process 1620 74ec501d9a7139f93d33aa4046ceb2ee.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
74ec501d9a7139f93d33aa4046ceb2ee.exe74ec501d9a7139f93d33aa4046ceb2ee.exepid process 1620 74ec501d9a7139f93d33aa4046ceb2ee.exe 2948 74ec501d9a7139f93d33aa4046ceb2ee.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
74ec501d9a7139f93d33aa4046ceb2ee.exe74ec501d9a7139f93d33aa4046ceb2ee.execmd.exedescription pid process target process PID 1620 wrote to memory of 2948 1620 74ec501d9a7139f93d33aa4046ceb2ee.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe PID 1620 wrote to memory of 2948 1620 74ec501d9a7139f93d33aa4046ceb2ee.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe PID 1620 wrote to memory of 2948 1620 74ec501d9a7139f93d33aa4046ceb2ee.exe 74ec501d9a7139f93d33aa4046ceb2ee.exe PID 2948 wrote to memory of 3032 2948 74ec501d9a7139f93d33aa4046ceb2ee.exe schtasks.exe PID 2948 wrote to memory of 3032 2948 74ec501d9a7139f93d33aa4046ceb2ee.exe schtasks.exe PID 2948 wrote to memory of 3032 2948 74ec501d9a7139f93d33aa4046ceb2ee.exe schtasks.exe PID 2948 wrote to memory of 4932 2948 74ec501d9a7139f93d33aa4046ceb2ee.exe cmd.exe PID 2948 wrote to memory of 4932 2948 74ec501d9a7139f93d33aa4046ceb2ee.exe cmd.exe PID 2948 wrote to memory of 4932 2948 74ec501d9a7139f93d33aa4046ceb2ee.exe cmd.exe PID 4932 wrote to memory of 1956 4932 cmd.exe schtasks.exe PID 4932 wrote to memory of 1956 4932 cmd.exe schtasks.exe PID 4932 wrote to memory of 1956 4932 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74ec501d9a7139f93d33aa4046ceb2ee.exe"C:\Users\Admin\AppData\Local\Temp\74ec501d9a7139f93d33aa4046ceb2ee.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\74ec501d9a7139f93d33aa4046ceb2ee.exeC:\Users\Admin\AppData\Local\Temp\74ec501d9a7139f93d33aa4046ceb2ee.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\74ec501d9a7139f93d33aa4046ceb2ee.exe" /TN aMYATtOZda0c /F3⤵
- Creates scheduled task(s)
PID:3032 -
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN aMYATtOZda0c > C:\Users\Admin\AppData\Local\Temp\fqygWxR1T.xml3⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN aMYATtOZda0c4⤵PID:1956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 6163⤵
- Program crash
PID:4024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 6083⤵
- Program crash
PID:488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 7163⤵
- Program crash
PID:3872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 7243⤵
- Program crash
PID:3932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 7443⤵
- Program crash
PID:3756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 7803⤵
- Program crash
PID:3160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 14723⤵
- Program crash
PID:1756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 19163⤵
- Program crash
PID:1476 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 21443⤵
- Program crash
PID:3312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 19323⤵
- Program crash
PID:496 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 21163⤵
- Program crash
PID:3732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 19323⤵
- Program crash
PID:3256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 21483⤵
- Program crash
PID:1204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 21923⤵
- Program crash
PID:1976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 19323⤵
- Program crash
PID:4908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 19643⤵
- Program crash
PID:2192 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 21523⤵
- Program crash
PID:4332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 7363⤵
- Program crash
PID:2052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2948 -ip 29481⤵PID:404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2948 -ip 29481⤵PID:4780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2948 -ip 29481⤵PID:484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2948 -ip 29481⤵PID:3252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2948 -ip 29481⤵PID:680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2948 -ip 29481⤵PID:4940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2948 -ip 29481⤵PID:2568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2948 -ip 29481⤵PID:3204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2948 -ip 29481⤵PID:544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2948 -ip 29481⤵PID:4508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2948 -ip 29481⤵PID:1464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2948 -ip 29481⤵PID:4816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2948 -ip 29481⤵PID:4416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2948 -ip 29481⤵PID:2516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2948 -ip 29481⤵PID:3700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2948 -ip 29481⤵PID:3012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2948 -ip 29481⤵PID:2872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2948 -ip 29481⤵PID:1976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\74ec501d9a7139f93d33aa4046ceb2ee.exeFilesize
501KB
MD5624840aa346a3051cadf19b03df6c16f
SHA17fb0302a9ee6ac027747090953a94dd6da08ea34
SHA2565a0b4847976f1768143c806e377395472fda578225108729fe5dbca5ef05ba95
SHA512c0b118c9eac47432254ddcbf9cd4da781eca3b86ee65a37195a8b2632236b477d904b2952579c529e822e9d5ff44995dfb04eef6b607c13e6edc572e646b3231
-
C:\Users\Admin\AppData\Local\Temp\fqygWxR1T.xmlFilesize
1KB
MD5b5bbacb931bda2fbd90183a8461dcd7c
SHA11ca7533ee99a6802cec6a5fb420e0ed5f87561b1
SHA2561935bb22aa48717e9722611299d6d4e049ae16f4c7480de03a779c37d473e73b
SHA512d645dd4446661b2d8773e584d463014713e23cf385fc6ea208f6acda1d9950c15d98bbe7437bf2620ab2885f9341c29f70ed19b43d8b93c54d72f969b8da749e
-
memory/1620-0-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB
-
memory/1620-1-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1620-3-0x0000000001760000-0x00000000017DE000-memory.dmpFilesize
504KB
-
memory/1620-13-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2948-14-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB
-
memory/2948-16-0x0000000001730000-0x00000000017AE000-memory.dmpFilesize
504KB
-
memory/2948-22-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/2948-24-0x0000000000470000-0x00000000004DB000-memory.dmpFilesize
428KB
-
memory/2948-41-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB