IOC Report
LwNdQo4zIk.exe

loading gif

Files

File Path
Type
Category
Malicious
LwNdQo4zIk.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Pyupydeoe.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_8e16aed3aa5676a94a41f4f83e9862e56aba6f4_82810a17_1425c040\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F7A.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Jan 5 16:43:08 2023, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA20B.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA26A.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\LwNdQo4zIk.exe
C:\Users\user\Desktop\LwNdQo4zIk.exe
 malicious
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Local\Temp\Pyupydeoe.tmp",Uprsprhaot
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 960

IPs

IP
Domain
Country
Malicious
192.168.2.1
unknown
unknown

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
AmiHivePermissionsCorrect
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
AmiHiveOwnerCorrect
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
ProgramId
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
FileId
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
LowerCaseLongPath
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
LongPathHash
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
Name
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
Publisher
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
Version
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
BinFileVersion
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
BinaryType
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
ProductName
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
ProductVersion
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
LinkDate
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
BinProductVersion
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
Size
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
Language
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
IsPeFile
\REGISTRY\A\{4a8c284c-1530-fd5b-703c-952a7259e469}\Root\InventoryApplicationFile\rundll32.exe|ab97b57a
IsOsComponent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug
ExceptionRecord
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
0018C008E4E08E7E
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
There are 14 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page readonly
4F00000
direct allocation
page execute and read and write
29D0000
heap
page read and write
53D0000
direct allocation
page read and write
5A90000
direct allocation
page read and write
5CDD000
stack
page read and write
5DF0000
direct allocation
page read and write
6DA0E000
unkown
page write copy
188E7250000
trusted library allocation
page read and write
284AF5C000
stack
page read and write
29DA000
heap
page read and write
5D20000
heap
page read and write
19B000
stack
page read and write
630000
heap
page read and write
188E6410000
trusted library allocation
page read and write
514000
unkown
page readonly
5D60000
direct allocation
page read and write
37A0000
direct allocation
page read and write
63A000
heap
page read and write
20F0000
heap
page read and write
6DA0B000
unkown
page read and write
28A0000
remote allocation
page read and write
401000
unkown
page execute read
6DA0F000
unkown
page readonly
6DA0A000
unkown
page readonly
2450000
direct allocation
page read and write
287B000
stack
page read and write
283C000
stack
page read and write
6D960000
unkown
page readonly
5EE000
stack
page read and write
4B70000
direct allocation
page read and write
264F000
stack
page read and write
416000
unkown
page execute read
30C0000
direct allocation
page read and write
284B379000
stack
page read and write
188E62D4000
heap
page read and write
224F000
stack
page read and write
284B479000
stack
page read and write
1F0000
trusted library allocation
page read and write
2540000
heap
page read and write
2330000
direct allocation
page execute and read and write
188E64C0000
trusted library allocation
page read and write
188E7040000
trusted library allocation
page read and write
29A5000
heap
page read and write
188E6540000
heap
page read and write
30000
heap
page read and write
8FF000
stack
page read and write
188E62DC000
heap
page read and write
188E64E0000
trusted library allocation
page read and write
2940000
heap
page read and write
5A80000
direct allocation
page read and write
188E62A1000
heap
page read and write
25D0000
heap
page read and write
2140000
heap
page read and write
6D961000
unkown
page execute read
188E62DC000
heap
page read and write
284B3FE000
stack
page read and write
418000
unkown
page write copy
188E64D0000
heap
page readonly
28E0000
trusted library allocation
page read and write
52A0000
heap
page read and write
188E64F0000
trusted library allocation
page read and write
188E6549000
heap
page read and write
188E6140000
heap
page read and write
284B2F9000
stack
page read and write
28A0000
remote allocation
page read and write
188E6420000
trusted library allocation
page read and write
29A0000
heap
page read and write
188E6290000
heap
page read and write
55E000
stack
page read and write
5A0000
heap
page read and write
400000
unkown
page execute and read and write
2CD0000
direct allocation
page read and write
188E6545000
heap
page read and write
2254000
trusted library allocation
page execute and read and write
188E62DC000
heap
page read and write
28A0000
remote allocation
page read and write
62E000
stack
page read and write
188E6550000
trusted library allocation
page read and write
50D000
unkown
page readonly
188E63B0000
heap
page read and write
5C9E000
stack
page read and write
188E6390000
heap
page read and write
9D000
stack
page read and write
188E6150000
trusted library allocation
page read and write
188E6480000
trusted library allocation
page read and write
There are 76 hidden memdumps, click here to show them.