Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 10:48
Static task
static1
Behavioral task
behavioral1
Sample
2715e2e331369c798ad9218355bc79e0bed9d8e4f6fdf165202ede645a158a7e.dll
Resource
win7-20240903-en
General
-
Target
2715e2e331369c798ad9218355bc79e0bed9d8e4f6fdf165202ede645a158a7e.dll
-
Size
4.7MB
-
MD5
0fd370a8f48b6f0f833fb24a77d98ae3
-
SHA1
579cbfbe20611958062b102652a4051a6b9a1be8
-
SHA256
2715e2e331369c798ad9218355bc79e0bed9d8e4f6fdf165202ede645a158a7e
-
SHA512
5f7be894f9f2675b7f8b4e643ce0d0cbbc3ab997856f8f51422f12c0978417de47d125d0ba88beb1334cdc974ff31030f4d8d570f46d74749e15437aa08f976e
-
SSDEEP
98304:9aTiZ7qe+aOKvp3QZ6/HbS9FugmTw3gvhiWaOuBuJ0Ato4z/ukDr:9aTiZ7qfRmp3QZ6/+9Fu/v0AmWh/
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:enabled:@shell32.dll,-1" rundll32.exe -
Ramnit family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 8 4164 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 1248 rundll32Srv.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\S: rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe -
resource yara_rule behavioral2/files/0x000c000000023b1b-2.dat upx behavioral2/memory/1248-4-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1248-13-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\px77A1.tmp rundll32Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2732 1248 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32Srv.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1248 rundll32Srv.exe 1248 rundll32Srv.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe 1248 rundll32Srv.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1248 rundll32Srv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1100 wrote to memory of 4164 1100 rundll32.exe 82 PID 1100 wrote to memory of 4164 1100 rundll32.exe 82 PID 1100 wrote to memory of 4164 1100 rundll32.exe 82 PID 4164 wrote to memory of 1248 4164 rundll32.exe 83 PID 4164 wrote to memory of 1248 4164 rundll32.exe 83 PID 4164 wrote to memory of 1248 4164 rundll32.exe 83 PID 1248 wrote to memory of 608 1248 rundll32Srv.exe 5 PID 1248 wrote to memory of 608 1248 rundll32Srv.exe 5 PID 1248 wrote to memory of 608 1248 rundll32Srv.exe 5 PID 1248 wrote to memory of 608 1248 rundll32Srv.exe 5 PID 1248 wrote to memory of 608 1248 rundll32Srv.exe 5 PID 1248 wrote to memory of 608 1248 rundll32Srv.exe 5 PID 1248 wrote to memory of 672 1248 rundll32Srv.exe 7 PID 1248 wrote to memory of 672 1248 rundll32Srv.exe 7 PID 1248 wrote to memory of 672 1248 rundll32Srv.exe 7 PID 1248 wrote to memory of 672 1248 rundll32Srv.exe 7 PID 1248 wrote to memory of 672 1248 rundll32Srv.exe 7 PID 1248 wrote to memory of 672 1248 rundll32Srv.exe 7 PID 1248 wrote to memory of 784 1248 rundll32Srv.exe 8 PID 1248 wrote to memory of 784 1248 rundll32Srv.exe 8 PID 1248 wrote to memory of 784 1248 rundll32Srv.exe 8 PID 1248 wrote to memory of 784 1248 rundll32Srv.exe 8 PID 1248 wrote to memory of 784 1248 rundll32Srv.exe 8 PID 1248 wrote to memory of 784 1248 rundll32Srv.exe 8 PID 1248 wrote to memory of 804 1248 rundll32Srv.exe 9 PID 1248 wrote to memory of 804 1248 rundll32Srv.exe 9 PID 1248 wrote to memory of 804 1248 rundll32Srv.exe 9 PID 1248 wrote to memory of 804 1248 rundll32Srv.exe 9 PID 1248 wrote to memory of 804 1248 rundll32Srv.exe 9 PID 1248 wrote to memory of 804 1248 rundll32Srv.exe 9 PID 1248 wrote to memory of 808 1248 rundll32Srv.exe 10 PID 1248 wrote to memory of 808 1248 rundll32Srv.exe 10 PID 1248 wrote to memory of 808 1248 rundll32Srv.exe 10 PID 1248 wrote to memory of 808 1248 rundll32Srv.exe 10 PID 1248 wrote to memory of 808 1248 rundll32Srv.exe 10 PID 1248 wrote to memory of 808 1248 rundll32Srv.exe 10 PID 1248 wrote to memory of 900 1248 rundll32Srv.exe 11 PID 1248 wrote to memory of 900 1248 rundll32Srv.exe 11 PID 1248 wrote to memory of 900 1248 rundll32Srv.exe 11 PID 1248 wrote to memory of 900 1248 rundll32Srv.exe 11 PID 1248 wrote to memory of 900 1248 rundll32Srv.exe 11 PID 1248 wrote to memory of 900 1248 rundll32Srv.exe 11 PID 1248 wrote to memory of 960 1248 rundll32Srv.exe 12 PID 1248 wrote to memory of 960 1248 rundll32Srv.exe 12 PID 1248 wrote to memory of 960 1248 rundll32Srv.exe 12 PID 1248 wrote to memory of 960 1248 rundll32Srv.exe 12 PID 1248 wrote to memory of 960 1248 rundll32Srv.exe 12 PID 1248 wrote to memory of 960 1248 rundll32Srv.exe 12 PID 1248 wrote to memory of 60 1248 rundll32Srv.exe 13 PID 1248 wrote to memory of 60 1248 rundll32Srv.exe 13 PID 1248 wrote to memory of 60 1248 rundll32Srv.exe 13 PID 1248 wrote to memory of 60 1248 rundll32Srv.exe 13 PID 1248 wrote to memory of 60 1248 rundll32Srv.exe 13 PID 1248 wrote to memory of 60 1248 rundll32Srv.exe 13 PID 1248 wrote to memory of 736 1248 rundll32Srv.exe 14 PID 1248 wrote to memory of 736 1248 rundll32Srv.exe 14 PID 1248 wrote to memory of 736 1248 rundll32Srv.exe 14 PID 1248 wrote to memory of 736 1248 rundll32Srv.exe 14 PID 1248 wrote to memory of 736 1248 rundll32Srv.exe 14 PID 1248 wrote to memory of 736 1248 rundll32Srv.exe 14 PID 1248 wrote to memory of 1004 1248 rundll32Srv.exe 15 PID 1248 wrote to memory of 1004 1248 rundll32Srv.exe 15 PID 1248 wrote to memory of 1004 1248 rundll32Srv.exe 15 PID 1248 wrote to memory of 1004 1248 rundll32Srv.exe 15
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:608
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:804
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:60
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:784
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:3156
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3820
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3916
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3984
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:4068
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3708
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:1332
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:456
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:1860
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:1680
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:736
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1104
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1116
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1200
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2684
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:112
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1272
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1448
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2528
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1596
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1604
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1724
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:2000
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:2008
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:1800
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2068
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2140
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2216
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2656
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2900
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2920
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3264
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3516
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2715e2e331369c798ad9218355bc79e0bed9d8e4f6fdf165202ede645a158a7e.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2715e2e331369c798ad9218355bc79e0bed9d8e4f6fdf165202ede645a158a7e.dll,#13⤵
- Modifies firewall policy service
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\rundll32Srv.exeC:\Windows\SysWOW64\rundll32Srv.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 3845⤵
- Program crash
PID:2732
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4952
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:2568
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4340
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:2292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:4592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1248 -ip 12481⤵PID:3688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD515c4d91b9254aa6a5d9cdf15a8c5fad1
SHA1b07290b367a128f452edad6de8de5e2acc9157b4
SHA256b169c634039baad537f3bed807d571efb6c5d3bed0088effa06fbdaa4bd362c8
SHA512007ac72c67af1ffa3d0e829dea45ae4a70ea3f537f281ec3f1add4253c3fa4b9e854887073b6c0dfed7cc7e058e3210a3cd9d259a5b1cd053dc0b64e6a5ae7ed