c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8.exe
Size

533KB
MD5

961da6366aa27edbd68cdd5dc5ed5cb8
SHA1

fbef4e3255ec8da0c956accad20fd1701093ac5f
SHA256

c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8
SHA512

2d4c00ce8d56a0680a5c79a782bcbc34116ebd8c28551e57ba780350440ae50adb47e402df5d1b6f2000ab7b25d53969e1d9c0eb5ea4040c1e438dd939e3dda1
SSDEEP

12288:0D6+Hc63W+9oTr3c8pt6xnQL/vwFeQfcd/S6k:0DoL+yTr3cosVfcd/S6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4836	ql3z9kshazqtnecuwr3.exe
2192	txeclxgunn.exe
2924	scucponskwg.exe
2592	txeclxgunn.exe
1424	scucponskwg.exe
3516	txeclxgunn.exe
4448	txeclxgunn.exe
692	scucponskwg.exe
3568	txeclxgunn.exe
60	scucponskwg.exe
5064	txeclxgunn.exe
1020	scucponskwg.exe
3396	txeclxgunn.exe
4716	scucponskwg.exe
540	txeclxgunn.exe
456	scucponskwg.exe
772	txeclxgunn.exe
4216	scucponskwg.exe
1384	txeclxgunn.exe
3408	scucponskwg.exe
3448	txeclxgunn.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	scucponskwg.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	scucponskwg.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	ql3z9kshazqtnecuwr3.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	scucponskwg.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	scucponskwg.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	scucponskwg.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	scucponskwg.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	scucponskwg.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	scucponskwg.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	scucponskwg.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe
File created	C:\Windows\uqdhcgazrcsd\f7b4rfoajv	txeclxgunn.exe

Program crash 11 IoCs

pid	pid_target	Process	procid_target
232	2192	WerFault.exe	86
3448	2592	WerFault.exe	93
4428	3516	WerFault.exe	98
4104	4448	WerFault.exe	101
3472	3568	WerFault.exe	105
4272	5064	WerFault.exe	109
3312	3396	WerFault.exe	113
2484	540	WerFault.exe	117
3532	772	WerFault.exe	121
4556	1384	WerFault.exe	127
928	3448	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txeclxgunn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txeclxgunn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scucponskwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txeclxgunn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txeclxgunn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scucponskwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txeclxgunn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txeclxgunn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txeclxgunn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scucponskwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ql3z9kshazqtnecuwr3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scucponskwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txeclxgunn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scucponskwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scucponskwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scucponskwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scucponskwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	txeclxgunn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scucponskwg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2192	txeclxgunn.exe
2192	txeclxgunn.exe
2924	scucponskwg.exe
2924	scucponskwg.exe
2924	scucponskwg.exe
2924	scucponskwg.exe
2924	scucponskwg.exe
2924	scucponskwg.exe
2592	txeclxgunn.exe
2592	txeclxgunn.exe
1424	scucponskwg.exe
1424	scucponskwg.exe
1424	scucponskwg.exe
1424	scucponskwg.exe
1424	scucponskwg.exe
1424	scucponskwg.exe
4448	txeclxgunn.exe
4448	txeclxgunn.exe
692	scucponskwg.exe
692	scucponskwg.exe
692	scucponskwg.exe
692	scucponskwg.exe
692	scucponskwg.exe
692	scucponskwg.exe
3568	txeclxgunn.exe
3568	txeclxgunn.exe
60	scucponskwg.exe
60	scucponskwg.exe
60	scucponskwg.exe
60	scucponskwg.exe
60	scucponskwg.exe
60	scucponskwg.exe
5064	txeclxgunn.exe
5064	txeclxgunn.exe
1020	scucponskwg.exe
1020	scucponskwg.exe
1020	scucponskwg.exe
1020	scucponskwg.exe
1020	scucponskwg.exe
1020	scucponskwg.exe
3396	txeclxgunn.exe
3396	txeclxgunn.exe
4716	scucponskwg.exe
4716	scucponskwg.exe
4716	scucponskwg.exe
4716	scucponskwg.exe
4716	scucponskwg.exe
4716	scucponskwg.exe
540	txeclxgunn.exe
540	txeclxgunn.exe
456	scucponskwg.exe
456	scucponskwg.exe
456	scucponskwg.exe
456	scucponskwg.exe
456	scucponskwg.exe
456	scucponskwg.exe
772	txeclxgunn.exe
772	txeclxgunn.exe
4216	scucponskwg.exe
4216	scucponskwg.exe
4216	scucponskwg.exe
4216	scucponskwg.exe
4216	scucponskwg.exe
4216	scucponskwg.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4836	4784	c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8.exe	84
PID 4784 wrote to memory of 4836	4784	c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8.exe	84
PID 4784 wrote to memory of 4836	4784	c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8.exe	84
PID 2192 wrote to memory of 2924	2192	txeclxgunn.exe	88
PID 2192 wrote to memory of 2924	2192	txeclxgunn.exe	88
PID 2192 wrote to memory of 2924	2192	txeclxgunn.exe	88
PID 2924 wrote to memory of 2592	2924	scucponskwg.exe	93
PID 2924 wrote to memory of 2592	2924	scucponskwg.exe	93
PID 2924 wrote to memory of 2592	2924	scucponskwg.exe	93
PID 2592 wrote to memory of 1424	2592	txeclxgunn.exe	94
PID 2592 wrote to memory of 1424	2592	txeclxgunn.exe	94
PID 2592 wrote to memory of 1424	2592	txeclxgunn.exe	94
PID 4836 wrote to memory of 3516	4836	ql3z9kshazqtnecuwr3.exe	98
PID 4836 wrote to memory of 3516	4836	ql3z9kshazqtnecuwr3.exe	98
PID 4836 wrote to memory of 3516	4836	ql3z9kshazqtnecuwr3.exe	98
PID 1424 wrote to memory of 4448	1424	scucponskwg.exe	101
PID 1424 wrote to memory of 4448	1424	scucponskwg.exe	101
PID 1424 wrote to memory of 4448	1424	scucponskwg.exe	101
PID 4448 wrote to memory of 692	4448	txeclxgunn.exe	102
PID 4448 wrote to memory of 692	4448	txeclxgunn.exe	102
PID 4448 wrote to memory of 692	4448	txeclxgunn.exe	102
PID 692 wrote to memory of 3568	692	scucponskwg.exe	105
PID 692 wrote to memory of 3568	692	scucponskwg.exe	105
PID 692 wrote to memory of 3568	692	scucponskwg.exe	105
PID 3568 wrote to memory of 60	3568	txeclxgunn.exe	106
PID 3568 wrote to memory of 60	3568	txeclxgunn.exe	106
PID 3568 wrote to memory of 60	3568	txeclxgunn.exe	106
PID 60 wrote to memory of 5064	60	scucponskwg.exe	109
PID 60 wrote to memory of 5064	60	scucponskwg.exe	109
PID 60 wrote to memory of 5064	60	scucponskwg.exe	109
PID 5064 wrote to memory of 1020	5064	txeclxgunn.exe	110
PID 5064 wrote to memory of 1020	5064	txeclxgunn.exe	110
PID 5064 wrote to memory of 1020	5064	txeclxgunn.exe	110
PID 1020 wrote to memory of 3396	1020	scucponskwg.exe	113
PID 1020 wrote to memory of 3396	1020	scucponskwg.exe	113
PID 1020 wrote to memory of 3396	1020	scucponskwg.exe	113
PID 3396 wrote to memory of 4716	3396	txeclxgunn.exe	114
PID 3396 wrote to memory of 4716	3396	txeclxgunn.exe	114
PID 3396 wrote to memory of 4716	3396	txeclxgunn.exe	114
PID 4716 wrote to memory of 540	4716	scucponskwg.exe	117
PID 4716 wrote to memory of 540	4716	scucponskwg.exe	117
PID 4716 wrote to memory of 540	4716	scucponskwg.exe	117
PID 540 wrote to memory of 456	540	txeclxgunn.exe	118
PID 540 wrote to memory of 456	540	txeclxgunn.exe	118
PID 540 wrote to memory of 456	540	txeclxgunn.exe	118
PID 456 wrote to memory of 772	456	scucponskwg.exe	121
PID 456 wrote to memory of 772	456	scucponskwg.exe	121
PID 456 wrote to memory of 772	456	scucponskwg.exe	121
PID 772 wrote to memory of 4216	772	txeclxgunn.exe	122
PID 772 wrote to memory of 4216	772	txeclxgunn.exe	122
PID 772 wrote to memory of 4216	772	txeclxgunn.exe	122
PID 4216 wrote to memory of 1384	4216	scucponskwg.exe	127
PID 4216 wrote to memory of 1384	4216	scucponskwg.exe	127
PID 4216 wrote to memory of 1384	4216	scucponskwg.exe	127
PID 1384 wrote to memory of 3408	1384	txeclxgunn.exe	128
PID 1384 wrote to memory of 3408	1384	txeclxgunn.exe	128
PID 1384 wrote to memory of 3408	1384	txeclxgunn.exe	128
PID 3408 wrote to memory of 3448	3408	scucponskwg.exe	133
PID 3408 wrote to memory of 3448	3408	scucponskwg.exe	133
PID 3408 wrote to memory of 3448	3408	scucponskwg.exe	133

C:\Users\Admin\AppData\Local\Temp\c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8.exe
"C:\Users\Admin\AppData\Local\Temp\c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784
- C:\uqdhcgazrcsd\ql3z9kshazqtnecuwr3.exe
  "C:\uqdhcgazrcsd\ql3z9kshazqtnecuwr3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\uqdhcgazrcsd\txeclxgunn.exe
    "C:\uqdhcgazrcsd\txeclxgunn.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 408
      4⤵
      Program crash
      PID:4428

C:\uqdhcgazrcsd\txeclxgunn.exe
C:\uqdhcgazrcsd\txeclxgunn.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192
- C:\uqdhcgazrcsd\scucponskwg.exe
  cgwcqlmqhtuw "c:\uqdhcgazrcsd\txeclxgunn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2924
- - \??\c:\uqdhcgazrcsd\txeclxgunn.exe
    "c:\uqdhcgazrcsd\txeclxgunn.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\uqdhcgazrcsd\scucponskwg.exe
      cgwcqlmqhtuw "c:\uqdhcgazrcsd\txeclxgunn.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1424
    - - \??\c:\uqdhcgazrcsd\txeclxgunn.exe
        
        "c:\uqdhcgazrcsd\txeclxgunn.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4448
      - C:\uqdhcgazrcsd\scucponskwg.exe
        
        cgwcqlmqhtuw "c:\uqdhcgazrcsd\txeclxgunn.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        \??\c:\uqdhcgazrcsd\txeclxgunn.exe
        
        "c:\uqdhcgazrcsd\txeclxgunn.exe"
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\uqdhcgazrcsd\scucponskwg.exe
        
        cgwcqlmqhtuw "c:\uqdhcgazrcsd\txeclxgunn.exe"
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        \??\c:\uqdhcgazrcsd\txeclxgunn.exe
        
        "c:\uqdhcgazrcsd\txeclxgunn.exe"
        9⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\uqdhcgazrcsd\scucponskwg.exe
        
        cgwcqlmqhtuw "c:\uqdhcgazrcsd\txeclxgunn.exe"
        10⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        \??\c:\uqdhcgazrcsd\txeclxgunn.exe
        
        "c:\uqdhcgazrcsd\txeclxgunn.exe"
        11⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\uqdhcgazrcsd\scucponskwg.exe
        
        cgwcqlmqhtuw "c:\uqdhcgazrcsd\txeclxgunn.exe"
        12⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        \??\c:\uqdhcgazrcsd\txeclxgunn.exe
        
        "c:\uqdhcgazrcsd\txeclxgunn.exe"
        13⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\uqdhcgazrcsd\scucponskwg.exe
        
        cgwcqlmqhtuw "c:\uqdhcgazrcsd\txeclxgunn.exe"
        14⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        \??\c:\uqdhcgazrcsd\txeclxgunn.exe
        
        "c:\uqdhcgazrcsd\txeclxgunn.exe"
        15⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\uqdhcgazrcsd\scucponskwg.exe
        
        cgwcqlmqhtuw "c:\uqdhcgazrcsd\txeclxgunn.exe"
        16⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        \??\c:\uqdhcgazrcsd\txeclxgunn.exe
        
        "c:\uqdhcgazrcsd\txeclxgunn.exe"
        17⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\uqdhcgazrcsd\scucponskwg.exe
        
        cgwcqlmqhtuw "c:\uqdhcgazrcsd\txeclxgunn.exe"
        18⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        \??\c:\uqdhcgazrcsd\txeclxgunn.exe
        
        "c:\uqdhcgazrcsd\txeclxgunn.exe"
        19⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:3448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 428
        20⤵
        Program crash
        
        PID:928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 488
        18⤵
        Program crash
        
        PID:4556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 488
        16⤵
        Program crash
        
        PID:3532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 484
        14⤵
        Program crash
        
        PID:2484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 488
        12⤵
        Program crash
        
        PID:3312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 488
        10⤵
        Program crash
        
        PID:4272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 488
        8⤵
        Program crash
        
        PID:3472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 488
        6⤵
        Program crash
        
        PID:4104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 500
      4⤵
      Program crash
      PID:3448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 520
  2⤵
  - Program crash
  PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2192 -ip 2192
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2592 -ip 2592
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3516 -ip 3516
1⤵
PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4448 -ip 4448
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3568 -ip 3568
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5064 -ip 5064
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3396 -ip 3396
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 540 -ip 540
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 772 -ip 772
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1384 -ip 1384
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3448 -ip 3448
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\uqdhcgazrcsd\f7b4rfoajv

Filesize
7B

MD5
facc8def0081ace528acc2fa81cf8cd1

SHA1
f60469055dc99902b6f9959c1950645bb94cf428

SHA256
1cf465cc96e1a1c17ce1ae9b883e4eae33b0209fe15e5703603a1ab7518ea3f0

SHA512
2dca95a08b6d976e3e69b58336097f832687756e3b8f6967e31b0160e8c73b246ed027eccbfa76ef02e1d416723baa41c0194b701bde7da111698b9751902a13

Download Submit
C:\uqdhcgazrcsd\ql3z9kshazqtnecuwr3.exe

Filesize
533KB

MD5
961da6366aa27edbd68cdd5dc5ed5cb8

SHA1
fbef4e3255ec8da0c956accad20fd1701093ac5f

SHA256
c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8

SHA512
2d4c00ce8d56a0680a5c79a782bcbc34116ebd8c28551e57ba780350440ae50adb47e402df5d1b6f2000ab7b25d53969e1d9c0eb5ea4040c1e438dd939e3dda1

Download Submit
C:\uqdhcgazrcsd\tkcdgzkbee9m

Filesize
4B

MD5
8f7126bb9e14fae4e03be8840e4f130d

SHA1
59acf1ac6cadb990c083fe59cee220278b8b6bdb

SHA256
7c4c83eddb17ba9d31c760bc58665cb4f94e9164dd61218485b591a6bcb5b20f

SHA512
2de1da46c183f97a72991d47bf38c12981072ffc38d116be9e02095ccedca808afe9196687998c540ee2105bbc724650524baa9d3381329554b469d3061476a5

Download Submit
C:\uqdhcgazrcsd\tkcdgzkbee9m

Filesize
4B

MD5
eaf855a746835547e68a570f42b9c0ef

SHA1
29e464c46afdc532b2c1e70895df8df49db334cb

SHA256
45446c87f4ca112be231ce15b739a45c7be995217b6c2290ae9d8c0392f2e365

SHA512
12e3ae3389dd9f9e5737dd2d1b97880801a417534bedd2148723571ad98e1615a5730c05f808f8cb69c3f914b81dbf8a36b119144d34759d47130caf13816d44

Download Submit
C:\uqdhcgazrcsd\tkcdgzkbee9m

Filesize
4B

MD5
26d3abeced4b782da5f8b07e6e88db0e

SHA1
54196a796f0c78ce0bf2e3dc119a308b992c0aff

SHA256
ede9a7ee29e24e2b03da9421f855497a083f5da1ecaeff51b02b63dd2b046714

SHA512
ff34311a29724fa2c7c2b6c3473dc8e7c4c96a6e72b2c47145c83878f8cb6f466c15446d67112e58c9c91877731b7502ea1dbd7ae3c4b79cf61fec45a69670b6

Download Submit
C:\uqdhcgazrcsd\tkcdgzkbee9m

Filesize
4B

MD5
6fca9cfbb182e82f7d98991b43411645

SHA1
fdcaaa70edafbd346f88f01f4f176577c7b816e2

SHA256
d0140781156f6e0fcd0a5265685b2480f502aaf6a1d0c6126fb5d99559934065

SHA512
8c48e830b921033fbffab64be96b7c603bee2bd71359d319e0cc8713316476b09db569138b170f9d8966dcdd9ca465232f62f97934a49b9835b4428939912b59

Download Submit
C:\uqdhcgazrcsd\tkcdgzkbee9m

Filesize
4B

MD5
0940fc686ed217a5fe44ceab312e8ee7

SHA1
9f0af71a6aeea4e2e63bb8b734822d9a6fe1e315

SHA256
a3cbbdf12e9802e3d18db3b55656e9db19e24c96d5f22e72ced4e483e080cad0

SHA512
0cde734e220ab5e880c5c509ff396acc0cae53ee86b6df69e62966f502381c620483e79b049467fda285b40340e496100bd9f49285981ac717be68c0e67edb54

Download Submit
C:\uqdhcgazrcsd\tkcdgzkbee9m

Filesize
4B

MD5
c56f8bc73feb6527861a6825c377e3f7

SHA1
cb7628b6bdeed1da681e14455f3106e82f7b72cd

SHA256
fa9c6d054d6e1c4faa996aa38ae03a0e30473d4656f67e5706bd2c377709f6dc

SHA512
cc815f879be8101dd6178d6c9921643048617c06eadf31544831976e445d2cc8fe7316844758ef6da6623fe3b2ffcb3817af27406fef4e1869c24e0b513c38c2

Download Submit
C:\uqdhcgazrcsd\tkcdgzkbee9m

Filesize
4B

MD5
6e070bac2cd414dd96ee1ed5f938512c

SHA1
77e8037a3a674fa09eddaddf023c13ea6a888848

SHA256
4be1b782e66ee1466015c0d123dbfe4b383f04d3b6da2025345db934fbd36938

SHA512
6072380f0c1ceee3abc26525b5703f3bae953cb366d8bdc5daf8133998100c8a3ad68853fc77acfc1730e52b4eb93852d790a18116f6a21f7d2bfc6f745b324f

Download Submit
C:\uqdhcgazrcsd\tkcdgzkbee9m

Filesize
4B

MD5
ef2c76bb28374e71cd5da22fd34073ca

SHA1
ff872140a4e88fa027f8c8e82200e3cbda7a9f9c

SHA256
d3ca0b1f688af31d97465f6e3a9dc951fc8b20c9a2b201bc3f45079460ab37a2

SHA512
8bfcfe646783a88335049d87915ff855ad3f4dc32f981754b99488e02a233cfd29555b3ff44aa79ca879140593110ee7a4d7656d01bc4cd8211351c1ce26c564

Download Submit
C:\uqdhcgazrcsd\tkcdgzkbee9m

Filesize
4B

MD5
ab76f7f45db3743f61d059332d883ea8

SHA1
ef34ff46a5d52158aec480a31b6a71ac04e021d5

SHA256
fc5aca703e725dd6eceb8379369c31f04513745e65b0098963f05e8d7dc4b0f1

SHA512
cd9ce0cebe04938e1d0b0134f32a59b54976ca68a56b2628bc0946cf1d80c9b9337d9ce661cd3bf06f540d7d57bd26e5b94c5e9926d8d57082eba77053ee99f1

Download Submit