IOC Report
Ou0ZT4968y.exe

loading gif

Files

File Path
Type
Category
Malicious
Ou0ZT4968y.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Ou0ZT4968y.exe_6d94c01abebf2aab25e322aa91a877df2b8acdd6_dac8cab9_0497fefa\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDFF8.tmp.dmp
Mini DuMP crash report, 14 streams, Fri Nov 25 03:47:14 2022, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1AF.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE24C.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
\Device\ConDrv
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Ou0ZT4968y.exe
C:\Users\user\Desktop\Ou0ZT4968y.exe
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 144

URLs

Name
IP
Malicious
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
https://gcc.gnu.org/bugs/):
unknown
https://sectigo.com/CPS0
unknown
https://studio.youtube.comSAPISIDHASH
unknown
https://studio.youtube.comX-Originapplication/jsonContent-TypesessionTokenctx
unknown
http://ocsp.sectigo.com0
unknown
https://studio.youtube.com
unknown
https://studio.youtube.com/reauth
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
AmiHivePermissionsCorrect
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
AmiHiveOwnerCorrect
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
ProgramId
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
FileId
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
LowerCaseLongPath
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
LongPathHash
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
Name
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
Publisher
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
Version
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
BinFileVersion
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
BinaryType
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
ProductName
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
ProductVersion
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
LinkDate
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
BinProductVersion
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
Size
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
Language
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
IsPeFile
\REGISTRY\A\{1e530eef-2f4b-2fce-1bd8-0875db519f52}\Root\InventoryApplicationFile\ou0zt4968y.exe|6912c8ab
IsOsComponent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
ExceptionRecord
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
00184009DD6AB7DA
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
There are 14 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
11F0000
unkown
page readonly
115F000
unkown
page execute read
1F856858000
heap
page read and write
51F0000
heap
page read and write
790000
heap
page read and write
4CAE7FF000
stack
page read and write
516F000
remote allocation
page read and write
1151000
unkown
page execute read
244592CA000
heap
page read and write
21CAD902000
heap
page read and write
1F856849000
heap
page read and write
2331E402000
heap
page read and write
114C522A000
heap
page read and write
96F97F000
stack
page read and write
1150000
unkown
page readonly
7ACF71C000
stack
page read and write
C60000
remote allocation
page read and write
D00000
heap
page read and write
24459313000
heap
page read and write
115B000
unkown
page execute read
56D4000
trusted library allocation
page read and write
790000
unkown
page read and write
114C5790000
trusted library allocation
page read and write
1C11DE5D000
heap
page read and write
114C526F000
heap
page read and write
24459243000
heap
page read and write
14EF000
unkown
page read and write
114C5900000
heap
page read and write
2331EA02000
trusted library allocation
page read and write
21CAD800000
heap
page read and write
1C11DE70000
heap
page read and write
1F85682A000
heap
page read and write
1F8581C0000
trusted library allocation
page read and write
96FC7E000
stack
page read and write
E02277B000
stack
page read and write
115F000
unkown
page execute read
1C11DE59000
heap
page read and write
25DA987B000
heap
page read and write
114C5C30000
heap
page read and write
1C11DE47000
heap
page read and write
781237F000
stack
page read and write
2331E990000
trusted library allocation
page read and write
563F000
stack
page read and write
21CAD838000
heap
page read and write
56C6000
trusted library allocation
page read and write
24459050000
heap
page read and write
403B2FF000
stack
page read and write
403A57B000
stack
page read and write
781247E000
stack
page read and write
114C5258000
heap
page read and write
2331E452000
heap
page read and write
14F6000
unkown
page readonly
1C11DE41000
heap
page read and write
E0225FC000
stack
page read and write
14F6000
unkown
page readonly
114C5C23000
heap
page read and write
24459266000
heap
page read and write
11EA000
unkown
page execute read
114C5C00000
heap
page read and write
1063000
direct allocation
page execute and read and write
115B000
unkown
page execute read
1F856802000
heap
page read and write