Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 16:53
Static task
static1
Behavioral task
behavioral1
Sample
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe
Resource
win7-20240508-en
General
-
Target
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe
-
Size
221KB
-
MD5
6621fcab4de5fab7eac4d8d03c87f233
-
SHA1
70dd77e26e803239877b30439eb123454bc137cc
-
SHA256
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2
-
SHA512
d132d2399c65b6b0083f7172c04d4708b28b3deceb93fd0c5dfc5bcfdfd9ee459c5b46853d176e08e99a2a8842945e6cd396e4137fac430c67abea388e83789c
-
SSDEEP
6144:WdwDpybdvNg134Gnq2YZstYaGaqjWq9441D/Kv+I:/cE134GiZ4Ya7mWq9441D/Kvj
Malware Config
Extracted
xenorat
91.92.248.167
Wolid_rat_nd8859g
-
delay
60000
-
install_path
appdata
-
port
1280
-
startup_name
cms
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Executes dropped EXE 4 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exepid process 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 2592 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 2120 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 4044 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exedescription pid process target process PID 1260 set thread context of 5000 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 set thread context of 772 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 set thread context of 1940 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 set thread context of 2592 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 set thread context of 2120 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 set thread context of 4044 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4316 772 WerFault.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe 3132 5000 WerFault.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exedescription pid process Token: SeDebugPrivilege 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe Token: SeDebugPrivilege 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exepid process 772 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exedescription pid process target process PID 1260 wrote to memory of 5000 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 5000 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 5000 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 5000 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 5000 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 5000 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 5000 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 5000 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 772 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 772 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 772 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 772 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 772 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 772 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 772 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 772 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 1940 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 1940 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 1940 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 1940 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 1940 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 1940 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 1940 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1260 wrote to memory of 1940 1260 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1940 wrote to memory of 1012 1940 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1940 wrote to memory of 1012 1940 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1940 wrote to memory of 1012 1940 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2592 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2592 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2592 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2592 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2592 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2592 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2592 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2592 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2120 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2120 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2120 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2120 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2120 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2120 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2120 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 2120 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 4044 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 4044 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 4044 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 4044 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 4044 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 4044 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 4044 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 1012 wrote to memory of 4044 1012 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe PID 2592 wrote to memory of 4128 2592 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe schtasks.exe PID 2592 wrote to memory of 4128 2592 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe schtasks.exe PID 2592 wrote to memory of 4128 2592 ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe2⤵PID:5000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 803⤵
- Program crash
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe2⤵
- Suspicious use of UnmapMainImage
PID:772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 123⤵
- Program crash
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Local\Temp\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "cms" /XML "C:\Users\Admin\AppData\Local\Temp\tmp31C9.tmp" /F5⤵
- Scheduled Task/Job: Scheduled Task
PID:4128 -
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe4⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeC:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe4⤵
- Executes dropped EXE
PID:4044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5000 -ip 50001⤵PID:3632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 772 -ip 7721⤵PID:3984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exe.logFilesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
C:\Users\Admin\AppData\Local\Temp\tmp31C9.tmpFilesize
1KB
MD54612375ad605d10e79d882b7afc296ca
SHA1fb4e4ece5c24ac82dc682c074a6512c0f658b9cb
SHA2566a61e18e644a02a278465f91e5ced51e2aeba0d3a8aff0e347dc78275e32eedb
SHA5124e4ad525b7b69d6ccc33b1d77d077c56df86cd7ba7cf5f02cfc78c1035f611d16249d5cedbd24297db5fcb1f4082e6aab60c447670f4996003fee77fd44478cb
-
C:\Users\Admin\AppData\Roaming\XenoManager\ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2.exeFilesize
221KB
MD56621fcab4de5fab7eac4d8d03c87f233
SHA170dd77e26e803239877b30439eb123454bc137cc
SHA256ac781121f63db7be4e5c79ea106118ce2c7a06f0abef01be3e54ff77351691e2
SHA512d132d2399c65b6b0083f7172c04d4708b28b3deceb93fd0c5dfc5bcfdfd9ee459c5b46853d176e08e99a2a8842945e6cd396e4137fac430c67abea388e83789c
-
memory/772-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1012-28-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1012-29-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1012-37-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1260-2-0x00000000057F0000-0x00000000057F6000-memory.dmpFilesize
24KB
-
memory/1260-6-0x000000000EB00000-0x000000000F0A4000-memory.dmpFilesize
5.6MB
-
memory/1260-4-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1260-3-0x000000000E3D0000-0x000000000E40A000-memory.dmpFilesize
232KB
-
memory/1260-1-0x0000000000FC0000-0x0000000000FFC000-memory.dmpFilesize
240KB
-
memory/1260-16-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1260-5-0x000000000E4B0000-0x000000000E54C000-memory.dmpFilesize
624KB
-
memory/1260-8-0x00000000052A0000-0x00000000052A6000-memory.dmpFilesize
24KB
-
memory/1260-0-0x00000000750EE000-0x00000000750EF000-memory.dmpFilesize
4KB
-
memory/1260-7-0x000000000E5F0000-0x000000000E682000-memory.dmpFilesize
584KB
-
memory/1940-27-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1940-15-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/2592-34-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/2592-38-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB