Analysis
-
max time kernel
139s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:28
Behavioral task
behavioral1
Sample
75180c4697c956890a9d6f385f243557.exe
Resource
win7-20231215-en
General
-
Target
75180c4697c956890a9d6f385f243557.exe
-
Size
1003KB
-
MD5
75180c4697c956890a9d6f385f243557
-
SHA1
73b3b6c88fd9470f06e3087dd3db8d816d159e70
-
SHA256
34aa2afdbc3a5b28cab5ce2e9de6db57d284990e02b6e0e4d433ea27a76ac3ce
-
SHA512
709e0a23a20ce6808810863a7ad539ca677915d64beb2c7d4213911833a3945de574ef9fb3adfd5988be875295b7cafa7831b04a15a706dab4e704c1287ffb49
-
SSDEEP
24576:aL/hdn4nYkeZbLOlpp9y92JcfP5L/itkBFwuiKN:aL/h54nheZbLODp9A2Je5L/jBFwuiKN
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
75180c4697c956890a9d6f385f243557.exepid process 5052 75180c4697c956890a9d6f385f243557.exe -
Executes dropped EXE 1 IoCs
Processes:
75180c4697c956890a9d6f385f243557.exepid process 5052 75180c4697c956890a9d6f385f243557.exe -
Processes:
resource yara_rule behavioral2/memory/1228-0-0x0000000000400000-0x000000000065C000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\75180c4697c956890a9d6f385f243557.exe upx behavioral2/memory/5052-14-0x0000000000400000-0x000000000065C000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Program crash 18 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2428 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 5104 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 3080 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 3060 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 2292 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 4012 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 1140 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 2596 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 1636 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 220 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 1488 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 4356 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 4880 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 3152 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 1512 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 648 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 4444 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe 4840 5052 WerFault.exe 75180c4697c956890a9d6f385f243557.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
75180c4697c956890a9d6f385f243557.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 75180c4697c956890a9d6f385f243557.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 75180c4697c956890a9d6f385f243557.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 75180c4697c956890a9d6f385f243557.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 75180c4697c956890a9d6f385f243557.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 75180c4697c956890a9d6f385f243557.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
75180c4697c956890a9d6f385f243557.exepid process 1228 75180c4697c956890a9d6f385f243557.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
75180c4697c956890a9d6f385f243557.exe75180c4697c956890a9d6f385f243557.exepid process 1228 75180c4697c956890a9d6f385f243557.exe 5052 75180c4697c956890a9d6f385f243557.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
75180c4697c956890a9d6f385f243557.exe75180c4697c956890a9d6f385f243557.execmd.exedescription pid process target process PID 1228 wrote to memory of 5052 1228 75180c4697c956890a9d6f385f243557.exe 75180c4697c956890a9d6f385f243557.exe PID 1228 wrote to memory of 5052 1228 75180c4697c956890a9d6f385f243557.exe 75180c4697c956890a9d6f385f243557.exe PID 1228 wrote to memory of 5052 1228 75180c4697c956890a9d6f385f243557.exe 75180c4697c956890a9d6f385f243557.exe PID 5052 wrote to memory of 3984 5052 75180c4697c956890a9d6f385f243557.exe schtasks.exe PID 5052 wrote to memory of 3984 5052 75180c4697c956890a9d6f385f243557.exe schtasks.exe PID 5052 wrote to memory of 3984 5052 75180c4697c956890a9d6f385f243557.exe schtasks.exe PID 5052 wrote to memory of 4220 5052 75180c4697c956890a9d6f385f243557.exe cmd.exe PID 5052 wrote to memory of 4220 5052 75180c4697c956890a9d6f385f243557.exe cmd.exe PID 5052 wrote to memory of 4220 5052 75180c4697c956890a9d6f385f243557.exe cmd.exe PID 4220 wrote to memory of 3328 4220 cmd.exe schtasks.exe PID 4220 wrote to memory of 3328 4220 cmd.exe schtasks.exe PID 4220 wrote to memory of 3328 4220 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75180c4697c956890a9d6f385f243557.exe"C:\Users\Admin\AppData\Local\Temp\75180c4697c956890a9d6f385f243557.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\75180c4697c956890a9d6f385f243557.exeC:\Users\Admin\AppData\Local\Temp\75180c4697c956890a9d6f385f243557.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\75180c4697c956890a9d6f385f243557.exe" /TN aMYATtOZda0c /F3⤵
- Creates scheduled task(s)
PID:3984 -
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN aMYATtOZda0c > C:\Users\Admin\AppData\Local\Temp\MZTZtU3.xml3⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN aMYATtOZda0c4⤵PID:3328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 6163⤵
- Program crash
PID:2428 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 6603⤵
- Program crash
PID:5104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 6683⤵
- Program crash
PID:3080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 7403⤵
- Program crash
PID:3060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 7323⤵
- Program crash
PID:2292 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 7203⤵
- Program crash
PID:4012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 14683⤵
- Program crash
PID:1140 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 19203⤵
- Program crash
PID:2596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 21443⤵
- Program crash
PID:1636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 19363⤵
- Program crash
PID:220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 19883⤵
- Program crash
PID:1488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 19483⤵
- Program crash
PID:4356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 19963⤵
- Program crash
PID:4880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 21963⤵
- Program crash
PID:3152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 19923⤵
- Program crash
PID:1512 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 21723⤵
- Program crash
PID:648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 19563⤵
- Program crash
PID:4444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 6563⤵
- Program crash
PID:4840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5052 -ip 50521⤵PID:3432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5052 -ip 50521⤵PID:3620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5052 -ip 50521⤵PID:1516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5052 -ip 50521⤵PID:500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5052 -ip 50521⤵PID:4552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5052 -ip 50521⤵PID:2800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5052 -ip 50521⤵PID:3812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5052 -ip 50521⤵PID:1272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5052 -ip 50521⤵PID:3592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5052 -ip 50521⤵PID:2728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5052 -ip 50521⤵PID:4604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5052 -ip 50521⤵PID:4328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5052 -ip 50521⤵PID:4804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5052 -ip 50521⤵PID:1972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5052 -ip 50521⤵PID:2076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5052 -ip 50521⤵PID:4792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5052 -ip 50521⤵PID:3080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5052 -ip 50521⤵PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\75180c4697c956890a9d6f385f243557.exeFilesize
1003KB
MD51f119b6de32a7f9f35fe6888ea16acd3
SHA1fa688ce8e725d403b4510ded7756fbf5bc6be68d
SHA25632def8fced1e62eb63d02533a476248c59b83f6ab59e5acd5594a3c9fea9154a
SHA512d3c3a7f1f0029935d39efcd1a497eb1bbfdb4e9da94a8d3e1ebbb3e45488be28db0977acc3770765d541a7037eeafb0d9f8b19b7ce6d89645a9e4c8ec7a32320
-
C:\Users\Admin\AppData\Local\Temp\MZTZtU3.xmlFilesize
1KB
MD582c45485903596c5ec0804610155889d
SHA1c8a7b0a9f353c2a17c06ffd47ebd9bd285dd9469
SHA256a798104283f7aa44127b904deb2138fd4920651b74de40504ee316209fb975b8
SHA512e93906496dc0459ffdf2e752017d4956128408be11b6d925e5da4a8b0899a0798a82ae1ba2c79ac3dcda8ae15b16c7cf2bd735e39f0e09b6a338301e940618f9
-
memory/1228-0-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB
-
memory/1228-1-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1228-2-0x0000000024FF0000-0x000000002506E000-memory.dmpFilesize
504KB
-
memory/1228-13-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/5052-14-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB
-
memory/5052-16-0x0000000001730000-0x00000000017AE000-memory.dmpFilesize
504KB
-
memory/5052-22-0x0000000000470000-0x00000000004DB000-memory.dmpFilesize
428KB
-
memory/5052-23-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/5052-40-0x0000000000400000-0x000000000065C000-memory.dmpFilesize
2.4MB