Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 01:22
Static task
static1
Behavioral task
behavioral1
Sample
4bfb82e4377cef81939ee33f12dbf3e45e8bbdf4fde3966b0576da1712512c0eN.dll
Resource
win7-20241023-en
General
-
Target
4bfb82e4377cef81939ee33f12dbf3e45e8bbdf4fde3966b0576da1712512c0eN.dll
-
Size
1.3MB
-
MD5
a144334228809a0b969104fc9fbcebb0
-
SHA1
3be701d9782bdb34fd324b70c1382ba587040833
-
SHA256
4bfb82e4377cef81939ee33f12dbf3e45e8bbdf4fde3966b0576da1712512c0e
-
SHA512
0562a77168a1d1b7292632c9ec4842adce02fcaf7ce8e34d709bc7dc86702c85574985ff3e78f8d780a0a437e58777c8e4e4af05e2c305403b976547ec107cc1
-
SSDEEP
12288:Y9g8GZHpzAac5naAd25L5O+FQ7lW8lZ60ICPxaf6og38BfSH6gqrandxT+is3pjn:Y68+O6pvbt/wuzTB2OFi1u
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:enabled:@shell32.dll,-1" rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List rundll32.exe -
Ramnit family
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\ETC\HOSTS rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 3988 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/memory/3988-20-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3988-23-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3988-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3988-17-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3988-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3988-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3988-21-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\pxB391.tmp rundll32mgr.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 3392 2456 WerFault.exe 83 4628 3988 WerFault.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3988 rundll32mgr.exe 3988 rundll32mgr.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe 3988 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3988 rundll32mgr.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3988 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1180 wrote to memory of 2456 1180 rundll32.exe 83 PID 1180 wrote to memory of 2456 1180 rundll32.exe 83 PID 1180 wrote to memory of 2456 1180 rundll32.exe 83 PID 2456 wrote to memory of 3988 2456 rundll32.exe 84 PID 2456 wrote to memory of 3988 2456 rundll32.exe 84 PID 2456 wrote to memory of 3988 2456 rundll32.exe 84 PID 3988 wrote to memory of 632 3988 rundll32mgr.exe 5 PID 3988 wrote to memory of 632 3988 rundll32mgr.exe 5 PID 3988 wrote to memory of 632 3988 rundll32mgr.exe 5 PID 3988 wrote to memory of 632 3988 rundll32mgr.exe 5 PID 3988 wrote to memory of 632 3988 rundll32mgr.exe 5 PID 3988 wrote to memory of 632 3988 rundll32mgr.exe 5 PID 3988 wrote to memory of 688 3988 rundll32mgr.exe 7 PID 3988 wrote to memory of 688 3988 rundll32mgr.exe 7 PID 3988 wrote to memory of 688 3988 rundll32mgr.exe 7 PID 3988 wrote to memory of 688 3988 rundll32mgr.exe 7 PID 3988 wrote to memory of 688 3988 rundll32mgr.exe 7 PID 3988 wrote to memory of 688 3988 rundll32mgr.exe 7 PID 3988 wrote to memory of 804 3988 rundll32mgr.exe 8 PID 3988 wrote to memory of 804 3988 rundll32mgr.exe 8 PID 3988 wrote to memory of 804 3988 rundll32mgr.exe 8 PID 3988 wrote to memory of 804 3988 rundll32mgr.exe 8 PID 3988 wrote to memory of 804 3988 rundll32mgr.exe 8 PID 3988 wrote to memory of 804 3988 rundll32mgr.exe 8 PID 3988 wrote to memory of 816 3988 rundll32mgr.exe 9 PID 3988 wrote to memory of 816 3988 rundll32mgr.exe 9 PID 3988 wrote to memory of 816 3988 rundll32mgr.exe 9 PID 3988 wrote to memory of 816 3988 rundll32mgr.exe 9 PID 3988 wrote to memory of 816 3988 rundll32mgr.exe 9 PID 3988 wrote to memory of 816 3988 rundll32mgr.exe 9 PID 3988 wrote to memory of 824 3988 rundll32mgr.exe 10 PID 3988 wrote to memory of 824 3988 rundll32mgr.exe 10 PID 3988 wrote to memory of 824 3988 rundll32mgr.exe 10 PID 3988 wrote to memory of 824 3988 rundll32mgr.exe 10 PID 3988 wrote to memory of 824 3988 rundll32mgr.exe 10 PID 3988 wrote to memory of 824 3988 rundll32mgr.exe 10 PID 3988 wrote to memory of 916 3988 rundll32mgr.exe 11 PID 3988 wrote to memory of 916 3988 rundll32mgr.exe 11 PID 3988 wrote to memory of 916 3988 rundll32mgr.exe 11 PID 3988 wrote to memory of 916 3988 rundll32mgr.exe 11 PID 3988 wrote to memory of 916 3988 rundll32mgr.exe 11 PID 3988 wrote to memory of 916 3988 rundll32mgr.exe 11 PID 3988 wrote to memory of 972 3988 rundll32mgr.exe 12 PID 3988 wrote to memory of 972 3988 rundll32mgr.exe 12 PID 3988 wrote to memory of 972 3988 rundll32mgr.exe 12 PID 3988 wrote to memory of 972 3988 rundll32mgr.exe 12 PID 3988 wrote to memory of 972 3988 rundll32mgr.exe 12 PID 3988 wrote to memory of 972 3988 rundll32mgr.exe 12 PID 3988 wrote to memory of 412 3988 rundll32mgr.exe 13 PID 3988 wrote to memory of 412 3988 rundll32mgr.exe 13 PID 3988 wrote to memory of 412 3988 rundll32mgr.exe 13 PID 3988 wrote to memory of 412 3988 rundll32mgr.exe 13 PID 3988 wrote to memory of 412 3988 rundll32mgr.exe 13 PID 3988 wrote to memory of 412 3988 rundll32mgr.exe 13 PID 3988 wrote to memory of 408 3988 rundll32mgr.exe 14 PID 3988 wrote to memory of 408 3988 rundll32mgr.exe 14 PID 3988 wrote to memory of 408 3988 rundll32mgr.exe 14 PID 3988 wrote to memory of 408 3988 rundll32mgr.exe 14 PID 3988 wrote to memory of 408 3988 rundll32mgr.exe 14 PID 3988 wrote to memory of 408 3988 rundll32mgr.exe 14 PID 3988 wrote to memory of 384 3988 rundll32mgr.exe 15 PID 3988 wrote to memory of 384 3988 rundll32mgr.exe 15 PID 3988 wrote to memory of 384 3988 rundll32mgr.exe 15 PID 3988 wrote to memory of 384 3988 rundll32mgr.exe 15
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:632
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:816
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:412
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:804
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:2992
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3748
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3880
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3940
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:4024
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:2244
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:3792
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4348
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:3664
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:556
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4320
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:916
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:408
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1052
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1144
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:432
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:1344
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1320
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1384
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2980
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1452
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1568
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1580
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1712
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1808
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1952
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1960
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1016
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2112
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2220
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2272
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2556
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2588
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:3192
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3352
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bfb82e4377cef81939ee33f12dbf3e45e8bbdf4fde3966b0576da1712512c0eN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bfb82e4377cef81939ee33f12dbf3e45e8bbdf4fde3966b0576da1712512c0eN.dll,#13⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 4245⤵
- Program crash
PID:4628
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 6124⤵
- Program crash
PID:3392
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4456
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:1092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4932
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:5096
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:2000
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2456 -ip 24562⤵PID:4852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3988 -ip 39882⤵PID:3300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD5787f5a2f9878eecd525f0ca2f7f71749
SHA1c0da1509885c34f2f40f6f557a366bba00d767b3
SHA256a96ea157adae6d6e44274d0b27a68074e24afd21973123dbacf1e5325aeb4438
SHA512306c9b2ce87ed7e5c8c7dd557927811bfe65dd49ae735a007e8189024376c5192bc5ef879a26d32e718746cc93b8343d05b6515c0a63fc85860a614dbb5b090d