Windows Analysis Report Auftragsbest#U00e4tigung Dringend.exe

ID:	491651
Product:	CloudBasic
Start time:	19:35:39
Start date:	27.09.2021
Sample:	Auftragsbest#U00e4tigung Dringend.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	b8d99b6c405fc56bd8a1448421d64eac
SHA1:	0ba8da5d51a77798010e6b1a2a8e759c8bcbe7fa
SHA256:	e2bf9e2c787866d86fc1ae939c378f7d22fab268a00ae163fff1b79332df2088
Filetype:	Win32 Executable (generic) a (10002005/4) 99.38%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Auftragsbest#U00_fc4fc4a7388d481e966f33dfe07a9685c50949f_fd6e1fa4_152df338\Report.wer	Little-endian UTF-16 Unicode text, with CRLF line terminators	5F550815AD78B4CE79C8CFDF70D64A2E	DB8759B0B3E8EE89272BA6136EC46DCC6F852EB1	656C7990FB99C617A43F9593A5C38533B2C857EEB3E7D117DCC0A6EDA5EABC04
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB3B.tmp.dmp	Mini DuMP crash report, 14 streams, Tue Sep 28 02:37:03 2021, 0x1205a4 type	E29D19EB206DEE826B86A011C022E50F	FE1ACBBE2EC8649F53F2236FE45307A3E4BC63B6	C889501BD8518D2A629E00AE5853A0A73440B1E13ACA98804F0A083CB0CECD46
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE4C2.tmp.WERInternalMetadata.xml	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators	5FD027C85FCAE639A283DFBA683DAE2F	932A899D679019E4CB6AB8FBB808520D4E2EF77B	85D7A537A31DE1CF4F8E6E9270289B2D6BC5B90750C7B1D60ECBAF3D1312AF2C
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE724.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	3C3A7CA283B828F191B4517026A3EAE9	D1CEBB7FAC080A1DD605BED92EC6EE59DAB67C06	201A777102B31BCE81BA3DF5DC1CF1B8F58DD4C746507C2A312119F5C97E9AFD

AV Detection:

Multi AV Scanner detection for submitted file

Source: Auftragsbest#U00e4tigung Dringend.exe	Virustotal: Detection: 59%			Perma Link
Source: Auftragsbest#U00e4tigung Dringend.exe	Metadefender: Detection: 40%			Perma Link
Source: Auftragsbest#U00e4tigung Dringend.exe	ReversingLabs: Detection: 78%

Compliance:

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Unpacked PE file: 0.2.Auftragsbest#U00e4tigung Dringend.exe.400000.0.unpack

Uses 32bit PE files

Source: Auftragsbest#U00e4tigung Dringend.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Binary contains paths to debug symbols

Source:	Binary string: wininet.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbk source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb'$ source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: mskeyprotect.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000008.00000002.357712390.0000000000632000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000008.00000003.349008039.0000000002C90000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdbf source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000008.00000003.349008039.0000000002C90000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdbe, source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb9$ source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb3$ source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: WINMMBASE.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdbc, source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdb5$ source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: winmm.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: gpapi.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: ncryptsslp.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb-$ source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: WINMMBASE.pdbq, source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbK, source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: comctl32v582.pdb source: WerFault.exe, 00000008.00000003.349008039.0000000002C90000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbi, source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000008.00000003.349008039.0000000002C90000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000008.00000003.349008039.0000000002C90000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp

Networking:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

URLs found in memory or binary data

Source: WerFault.exe, 00000008.00000002.358477729.00000000048F7000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: http://explore.live.com/windows-live-sign-in-
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: http://explore.live.com/windows-live-sign-in-single-use-code-faq
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.liv
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/ChangePassword?uaid=4f0848c3dca44c8bb07d7e02024d3e5a
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/security/LoginStage.aspx?lmif=1000&ru
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/security/LoginStage.aspx?lmif=1000&ru=https://login.live.com/login.srf%3Fwa
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/username/recover?wreply=https://login.live.com/login.srf%3flc%3d1033%26mkt%
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.331758301.0000000002D64000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000003.326146743.0000000002D60000.00000004.00000001.sdmp	String found in binary or memory: https://acctcdn.msauth.net
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.331758301.0000000002D64000.00000004.00000001.sdmp	String found in binary or memory: https://acctcdn.msauth.net/
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.331758301.0000000002D64000.00000004.00000001.sdmp	String found in binary or memory: https://acctcdn.msftauth.net/
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.331758301.0000000002D64000.00000004.00000001.sdmp	String found in binary or memory: https://acctcdnmsftuswe2.azureedge.net/
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.331758301.0000000002D64000.00000004.00000001.sdmp	String found in binary or memory: https://acctcdnvzeuno.azureedge.net/
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://github.com/login/oauth/authorize?response_type=code&client
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://github.com/login/oauth/authorize?response_type=code&client_id=e37ffdec11c0245cb2e0&scope=rea
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://lgincdnmsftuswe2.azureed
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000003.326146743.0000000002D60000.00000004.00000001.sdmp	String found in binary or memory: https://lgincdnmsftuswe2.azureedge.net/
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000003.326146743.0000000002D60000.00000004.00000001.sdmp	String found in binary or memory: https://lgincdnvzeuno.azureedge.net/
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/GetCredentialType.srf?opid=37C93C0CE0563237&id=250206&uiflavor=w
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/GetCredentialType.srf?opid=37C93C0CE0563237&id=250206&uiflavor=web&wa=wsignin
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/GetSessionState.srf?uiflavor=web&wa=wsignin1.0&rpsnv=13&ct=1632764213&rver=7
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/GetSessionState.srf?uiflavor=web&wa=wsignin1.0&rpsnv=13&ct=1632764213&rver=7.
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/HandleGithubResponse.srf&allow_signup=false&state=37C93C0CE0563237
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/Me.htm?v=3&
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/Me.htm?v=3&uaid=4f0848c3dca44c8bb07d7e02024d3e5a
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/cookiesDisabled.srf?uaid=4f0848c3dca44c8bb07d7e02024d3e5a&mkt=EN-US&lc=1033
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&uaid=4f0848c3dca44c8bb07d7e0202
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&uaid=4f0848c3dca44c8bb07d7e02024d
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-US&uaid=4f0848c3dca44c8bb07d7e02024d3e
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/jsDi
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/login.srf%3Fwa%3Dwsignin1.0%26rpsnv%3D13%26ct%3D1632764213%26rver%3D7.3.6962.
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/login.srf%3flc%3d1033%26mkt%3dEN-US%26wa%3dwsignin1.0%26rpsnv%3d13%26ct%3d163
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1632764213&rver=7.3.6962.0&wp=MBI_SS
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000003.326146743.0000000002D60000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1632764213&rver=7.3.6962.0&wp=MBI_SSL_SHA
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1632764
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1632764213&rver=7.3.6962.0&wp=MBI_SSL_SH
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/ppsecure/post.srf?wa=wsignin1.0&rpsnv
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/ppsecure/post.srf?wa=wsignin1.0&rpsnv=13&ct=1632764213&rver=7.3.6962.0&wp=MBI
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.mic
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.331758301.0000000002D64000.00000004.00000001.sdmp	String found in binary or memory: https://logincdn.msauth.net
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000003.326146743.0000000002D60000.00000004.00000001.sdmp	String found in binary or memory: https://logincdn.msauth.net/
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/16.000.29174.3/images/Windows_Live_v_thumb.jpg
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/16.000.29174.3/images/f
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/16.000.29174.3/images/favicon.ico
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000003.326146743.0000000002D60000.00000004.00000001.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_3ParxANZ-MNmIfU_UoPk
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.331642833.000000000285D000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000003.326167184.0000000002D6C000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.331758301.0000000002D64000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000003.326146743.0000000002D60000.00000004.00000001.sdmp	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_OjveJe7WDNHIjSCucBEfkA2.js
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://onedrive.live.com/download%3fcid%3d1B877C3EDE919037%26resid%3d1B877C3EDE919037%2521441%26aut
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.336607773.0000000002D0C000.00000004.00000001.sdmp	String found in binary or memory: https://onedrive.live.com/download?cid=1B877C3EDE919037&resid=1B877C3EDE919037%21441&authkey=AMAxN3s
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://onedrive.live.com/preload?view=Folders.All&id=250206&mkt=EN-US
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://p.sfx.ms/login/v1/head
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://p.sfx.ms/login/v1/header.html?id=250206&mkt=EN-US&cbcxt=sky
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://sc.imp.live.com/content/dam/imp/surfaces/mail_signin/v3/sky/EN-US.html?id=250206&mkt=EN-US&c
Source: WerFault.exe, 00000008.00000002.358414134.00000000048B9000.00000004.00000001.sdmp	String found in binary or memory: https://watson.telemetry.micro

System Summary:

Uses 32bit PE files

Source: Auftragsbest#U00e4tigung Dringend.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

One or more processes crash

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6412 -s 1928

PE file contains strange resources

Source: Auftragsbest#U00e4tigung Dringend.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Auftragsbest#U00e4tigung Dringend.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample is known by Antivirus

Source: Auftragsbest#U00e4tigung Dringend.exe	Virustotal: Detection: 59%
Source: Auftragsbest#U00e4tigung Dringend.exe	Metadefender: Detection: 40%
Source: Auftragsbest#U00e4tigung Dringend.exe	ReversingLabs: Detection: 78%

Sample reads its own file content

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

File read: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Jump to behavior

Creates temporary files

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB3B.tmp

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using Borland Delphi (Probably coded in Delphi)

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Classification label

Source: classification engine

Classification label: mal64.troj.evad.winEXE@2/4@1/0

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe 'C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe'
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6412 -s 1928

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Creates mutexes

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6412

Reads the hosts file

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: wininet.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbk source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb'$ source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: mskeyprotect.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000008.00000002.357712390.0000000000632000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000008.00000003.349008039.0000000002C90000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdbf source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000008.00000003.349008039.0000000002C90000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdbe, source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb9$ source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb3$ source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: WINMMBASE.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdbc, source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdb5$ source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: winmm.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: gpapi.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: ncryptsslp.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb-$ source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: WINMMBASE.pdbq, source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbK, source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: comctl32v582.pdb source: WerFault.exe, 00000008.00000003.349008039.0000000002C90000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbi, source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000008.00000003.348988021.0000000002C98000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000008.00000003.349008039.0000000002C90000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000008.00000003.348982693.0000000002C95000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000008.00000003.348909735.0000000004D61000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000008.00000003.349008039.0000000002C90000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000008.00000003.348856243.0000000002C9C000.00000004.00000040.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Unpacked PE file: 0.2.Auftragsbest#U00e4tigung Dringend.exe.400000.0.unpack

Yara detected DBatLoader

Source: Yara match	File source: 00000000.00000000.335989572.00000000022D4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.359668603.00000000022D4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.331391128.00000000022D4000.00000004.00000001.sdmp, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D63AB2 push ebx; ret		0_3_02D63AB3
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Code function: 0_3_02D71487 push edi; iretd		0_3_02D71496

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: WerFault.exe, 00000008.00000002.358464621.00000000048E5000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Process queried: DebugPort

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.335931295.0000000000E60000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.335931295.0000000000E60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.335931295.0000000000E60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000000.00000000.335931295.0000000000E60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock