Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2025, 01:19
Static task
static1
Behavioral task
behavioral1
Sample
d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe
Resource
win7-20240903-en
General
-
Target
d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe
-
Size
1.2MB
-
MD5
a21f1b0246976d5217a498de945bee79
-
SHA1
b13939d46afc71db2bf7c47ebedd6f3a0b1a0d44
-
SHA256
d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7
-
SHA512
378ddc6ae5c295896103c05e217c171807b0ce1e9757bc8ba0d973491d3225793378eeccb766b4e5369d053cd4d944d338e5e21f39558e9f7e5222c23420ddda
-
SSDEEP
24576:/J/94IkAJHjv1RIAhjLoamMiX4lNmZg0YxegPbUIDPP:/BugJHFjLoyEkmZ9Y14
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AgentTesla payload 5 IoCs
resource yara_rule behavioral2/memory/368-1-0x0000000000330000-0x000000000045F000-memory.dmp family_agenttesla behavioral2/memory/368-2-0x0000000000330000-0x000000000045F000-memory.dmp family_agenttesla behavioral2/memory/4744-6-0x0000000000330000-0x000000000045F000-memory.dmp family_agenttesla behavioral2/memory/1524-5-0x0000000000330000-0x000000000045F000-memory.dmp family_agenttesla behavioral2/memory/4744-4-0x0000000000330000-0x000000000045F000-memory.dmp family_agenttesla -
Program crash 1 IoCs
pid pid_target Process procid_target 1604 3464 WerFault.exe 118 -
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe -
Suspicious behavior: MapViewOfSection 18 IoCs
pid Process 4928 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 368 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 1524 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 4744 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 4044 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 3404 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 2304 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 3084 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 232 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 1620 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 4252 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 1840 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 1892 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 1580 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 2808 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 3720 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 548 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 3432 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 2764 4928 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 83 PID 4928 wrote to memory of 2764 4928 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 83 PID 4928 wrote to memory of 2764 4928 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 83 PID 4928 wrote to memory of 368 4928 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 84 PID 4928 wrote to memory of 368 4928 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 84 PID 4928 wrote to memory of 368 4928 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 84 PID 368 wrote to memory of 3128 368 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 85 PID 368 wrote to memory of 3128 368 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 85 PID 368 wrote to memory of 3128 368 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 85 PID 368 wrote to memory of 1524 368 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 86 PID 368 wrote to memory of 1524 368 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 86 PID 368 wrote to memory of 1524 368 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 86 PID 1524 wrote to memory of 4824 1524 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 87 PID 1524 wrote to memory of 4824 1524 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 87 PID 1524 wrote to memory of 4824 1524 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 87 PID 1524 wrote to memory of 4744 1524 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 88 PID 1524 wrote to memory of 4744 1524 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 88 PID 1524 wrote to memory of 4744 1524 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 88 PID 4744 wrote to memory of 5060 4744 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 89 PID 4744 wrote to memory of 5060 4744 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 89 PID 4744 wrote to memory of 5060 4744 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 89 PID 4744 wrote to memory of 4044 4744 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 90 PID 4744 wrote to memory of 4044 4744 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 90 PID 4744 wrote to memory of 4044 4744 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 90 PID 4044 wrote to memory of 2040 4044 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 91 PID 4044 wrote to memory of 2040 4044 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 91 PID 4044 wrote to memory of 2040 4044 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 91 PID 4044 wrote to memory of 3404 4044 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 92 PID 4044 wrote to memory of 3404 4044 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 92 PID 4044 wrote to memory of 3404 4044 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 92 PID 3404 wrote to memory of 936 3404 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 93 PID 3404 wrote to memory of 936 3404 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 93 PID 3404 wrote to memory of 936 3404 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 93 PID 3404 wrote to memory of 2304 3404 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 94 PID 3404 wrote to memory of 2304 3404 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 94 PID 3404 wrote to memory of 2304 3404 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 94 PID 2304 wrote to memory of 3944 2304 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 95 PID 2304 wrote to memory of 3944 2304 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 95 PID 2304 wrote to memory of 3944 2304 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 95 PID 2304 wrote to memory of 3084 2304 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 96 PID 2304 wrote to memory of 3084 2304 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 96 PID 2304 wrote to memory of 3084 2304 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 96 PID 3084 wrote to memory of 5028 3084 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 97 PID 3084 wrote to memory of 5028 3084 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 97 PID 3084 wrote to memory of 5028 3084 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 97 PID 3084 wrote to memory of 232 3084 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 98 PID 3084 wrote to memory of 232 3084 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 98 PID 3084 wrote to memory of 232 3084 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 98 PID 232 wrote to memory of 3132 232 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 99 PID 232 wrote to memory of 3132 232 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 99 PID 232 wrote to memory of 3132 232 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 99 PID 232 wrote to memory of 1620 232 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 100 PID 232 wrote to memory of 1620 232 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 100 PID 232 wrote to memory of 1620 232 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 100 PID 1620 wrote to memory of 2936 1620 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 101 PID 1620 wrote to memory of 2936 1620 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 101 PID 1620 wrote to memory of 2936 1620 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 101 PID 1620 wrote to memory of 4252 1620 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 102 PID 1620 wrote to memory of 4252 1620 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 102 PID 1620 wrote to memory of 4252 1620 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 102 PID 4252 wrote to memory of 4872 4252 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 103 PID 4252 wrote to memory of 4872 4252 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 103 PID 4252 wrote to memory of 4872 4252 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 103 PID 4252 wrote to memory of 1840 4252 d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"2⤵PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"3⤵PID:3128
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"4⤵PID:4824
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"5⤵PID:5060
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"6⤵PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"7⤵PID:936
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"8⤵PID:3944
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"9⤵PID:5028
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"9⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"10⤵PID:3132
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"10⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"11⤵PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"11⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"12⤵PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"13⤵PID:2108
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"13⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"14⤵PID:1196
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"14⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"15⤵PID:3416
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"15⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"16⤵PID:2104
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"16⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"17⤵PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"17⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:548 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"18⤵PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"18⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"19⤵PID:3884
-
-
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"19⤵
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"C:\Users\Admin\AppData\Local\Temp\d0bc3072a017d0530371c3a263e32b0db3eebffcc7c4099d2678d39ee26a73a7.exe"20⤵PID:3036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 58820⤵
- Program crash
PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3464 -ip 34641⤵PID:2536