IOC Report
vy3mvlAaCZ.exe

loading gif

Files

File Path
Type
Category
Malicious
vy3mvlAaCZ.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vy3mvlAaCZ.exe_6074d93d852c1785169ec71e797e6a243c122_d0e789f3_15f13808\Report.wer
Little-endian UTF-16 Unicode text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C8E.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Sep 1 06:51:57 2022, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2EB2.tmp.WERInternalMetadata.xml
XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER300B.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\vy3mvlAaCZ.exe
"C:\Users\user\Desktop\vy3mvlAaCZ.exe"
malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 244

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
AmiHivePermissionsCorrect
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
AmiHiveOwnerCorrect
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
ProgramId
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
FileId
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
LowerCaseLongPath
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
LongPathHash
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
Name
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
Publisher
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
Version
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
BinFileVersion
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
BinaryType
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
ProductName
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
ProductVersion
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
LinkDate
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
BinProductVersion
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
Size
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
Language
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
IsPeFile
\REGISTRY\A\{be1f411e-38ba-7b6c-52b8-c8471f6bb0a1}\Root\InventoryApplicationFile\vy3mvlaacz.exe|9c7091c0
IsOsComponent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
ExceptionRecord
There are 10 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1164000
unkown
page write copy
 malicious
1164000
unkown
page write copy
 malicious
1163000
unkown
page write copy
 malicious
1164000
unkown
page write copy
 malicious
19489D60000
trusted library allocation
page read and write
1B01486C000
heap
page read and write
6D965FB000
stack
page read and write
19489EFC000
heap
page read and write
1B602B00000
heap
page read and write
1B014800000
heap
page read and write
8FB2FA000
stack
page read and write
8D73E7A000
stack
page read and write
DF746FF000
stack
page read and write
194857E0000
trusted library section
page readonly
C3C000
stack
page read and write
19484677000
heap
page read and write
1C7C0A00000
heap
page read and write
1163000
unkown
page read and write
1B014869000
heap
page read and write
1C7C0A3C000
heap
page read and write
1C7C1202000
trusted library allocation
page read and write
DFA000
heap
page read and write
1B602B5B000
heap
page read and write
1C7C0A43000
heap
page read and write
19489E2C000
heap
page read and write
1B602B66000
heap
page read and write
1B6020A5000
heap
page read and write
1B6020A6000
heap
page read and write
23A4B580000
trusted library allocation
page read and write
4FEBF7D000
stack
page read and write
1B01487C000
heap
page read and write
1B602089000
heap
page read and write
19485000000
heap
page read and write
1B602B55000
heap
page read and write
1151000
unkown
page execute read
19489E64000
heap
page read and write
19484530000
heap
page read and write
1B602B57000
heap
page read and write
19485BA0000
trusted library allocation
page read and write
1B602B5A000
heap
page read and write
1B6020A3000
heap
page read and write
23A4B4F0000
heap
page read and write
1948B000000
heap
page read and write
1B01486B000
heap
page read and write
85986FE000
stack
page read and write
1B014885000
heap
page read and write
4FEC27E000
stack
page read and write
8598B7F000
stack
page read and write
1B014902000
heap
page read and write
1B014849000
heap
page read and write
10FE000
stack
page read and write
1B014845000
heap
page read and write
194857D0000
trusted library section
page readonly
1B602B5A000
heap
page read and write
23A4B65C000
heap
page read and write
1948463D000
heap
page read and write
1C7C0990000
trusted library allocation
page read and write
23A4B629000
heap
page read and write
19484626000
heap
page read and write
1B015002000
trusted library allocation
page read and write
1B602B72000
heap
page read and write
1B014670000
heap
page read and write
19489E00000
heap
page read and write
194846FD000
heap
page read and write
10FE000
stack
page read and write
23A4B613000
heap
page read and write
1B601FC0000
heap
page read and write
250E3829000
heap
page read and write
1B014843000
heap
page read and write
19489C30000
trusted library allocation
page read and write
1B602B2A000
heap
page read and write
1B01487B000
heap
page read and write
1B602B56000
heap
page read and write
19489E8A000
heap
page read and write
19489EA1000
heap
page read and write
1B602B72000
heap
page read and write
6D9687E000
stack
page read and write
DF73CFC000
stack
page read and write
194856F0000
trusted library allocation
page read and write
4FEC0FD000
stack
page read and write
8D7407E000
stack
page read and write
19489D40000
trusted library allocation
page read and write
1B014875000
heap
page read and write