IOC Report
17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

loading gif

Files

File Path
Type
Category
Malicious
17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_32X35O1GVFF441YB_b619331d6ebfaa752cb39228ca38361cc95838_cdc271f5_2bffae22-1b23-4138-931c-592607ee6959\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER96BA.tmp.dmp
Mini DuMP crash report, 16 streams, Tue Apr 23 06:13:35 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER989F.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER98DF.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe
"C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe"
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7100 -s 1572

URLs

Name
IP
Malicious
aprilxrwonew8450.duckdns.org
malicious
http://upx.sf.net
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
aprilxrwonew8450.duckdns.org
134.255.217.251
 malicious

IPs

IP
Domain
Country
Malicious
134.255.217.251
aprilxrwonew8450.duckdns.org
Germany
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
ProgramId
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
FileId
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
LowerCaseLongPath
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
LongPathHash
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
Name
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
OriginalFileName
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
Publisher
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
Version
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
BinFileVersion
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
BinaryType
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
ProductName
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
ProductVersion
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
LinkDate
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
BinProductVersion
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
AppxPackageFullName
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
AppxPackageRelativeId
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
Size
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
Language
\REGISTRY\A\{9da368bc-7023-b88e-52fe-99e18a15c742}\Root\InventoryApplicationFile\1713852067459562|7bf482f84f5ef702
Usn
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3C2000
unkown
page readonly
 malicious
28B1000
trusted library allocation
page read and write
 malicious
830000
heap
page read and write
983000
heap
page read and write
1C03D000
stack
page read and write
905000
heap
page read and write
9D2000
heap
page read and write
880000
heap
page read and write
7FF848E10000
trusted library allocation
page read and write
7FF848E12000
trusted library allocation
page read and write
1B469000
heap
page read and write
CE0000
heap
page read and write
2A82000
trusted library allocation
page read and write
CA0000
heap
page execute and read and write
8D0000
trusted library allocation
page read and write
8FC000
heap
page read and write
7FF848EB0000
trusted library allocation
page read and write
286E000
stack
page read and write
7FF848E03000
trusted library allocation
page execute and read and write
2710000
heap
page read and write
128B8000
trusted library allocation
page read and write
711000
stack
page read and write
3C0000
unkown
page readonly
1B420000
heap
page read and write
1B900000
heap
page read and write
BEE000
stack
page read and write
1B213000
heap
page read and write
750000
heap
page read and write
1A8E0000
trusted library allocation
page read and write
95D000
heap
page read and write
885000
heap
page read and write
7FF848E00000
trusted library allocation
page read and write
890000
heap
page read and write
97D000
heap
page read and write
7FF848E1D000
trusted library allocation
page execute and read and write
3C0000
unkown
page readonly
91F000
heap
page read and write
1BF3C000
stack
page read and write
128C1000
trusted library allocation
page read and write
1BE38000
stack
page read and write
C03000
trusted library allocation
page read and write
1B165000
stack
page read and write
7FF848FB0000
trusted library allocation
page read and write
91A000
heap
page read and write
7FF848F20000
trusted library allocation
page execute and read and write
7FF445020000
trusted library allocation
page execute and read and write
933000
heap
page read and write
7FF848E0D000
trusted library allocation
page execute and read and write
1B71E000
stack
page read and write
930000
heap
page read and write
1B319000
stack
page read and write
7FF848EBC000
trusted library allocation
page execute and read and write
1B414000
stack
page read and write
7FF848E04000
trusted library allocation
page read and write
7FF848EB6000
trusted library allocation
page read and write
7FF848EC0000
trusted library allocation
page execute and read and write
7FF848FA0000
trusted library allocation
page read and write
967000
heap
page read and write
2729000
heap
page read and write
8F0000
heap
page read and write
268F000
stack
page read and write
BF0000
trusted library allocation
page read and write
850000
heap
page read and write
96B000
heap
page read and write
28A0000
heap
page execute and read and write
1B430000
heap
page read and write
1AD2C000
stack
page read and write
7FF848E2D000
trusted library allocation
page execute and read and write
1B493000
heap
page read and write
1B422000
heap
page read and write
CE5000
heap
page read and write
128B1000
trusted library allocation
page read and write
AEE000
stack
page read and write
7FF848EE6000
trusted library allocation
page execute and read and write
7FF848FC0000
trusted library allocation
page execute and read and write
7FF848E5C000
trusted library allocation
page execute and read and write
7FF848E20000
trusted library allocation
page read and write
1B81E000
stack
page read and write
C50000
heap
page read and write
1B210000
heap
page read and write
1B61F000
stack
page read and write
C00000
trusted library allocation
page read and write
There are 72 hidden memdumps, click here to show them.