IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_2db7612a235b1823c476f2f7c37c3d2280d4ef70_4149fb10_1ad28681\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER68D7.tmp.dmp
Mini DuMP crash report, 15 streams, Wed Jun 7 00:18:22 2023, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER73C5.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7462.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
C:\Users\user\Desktop\file.exe
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5788 -s 944

URLs

Name
IP
Malicious
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProgramId
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
FileId
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LowerCaseLongPath
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LongPathHash
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Name
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Publisher
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Version
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinFileVersion
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinaryType
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductName
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductVersion
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LinkDate
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinProductVersion
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Size
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Language
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
IsPeFile
 malicious
\REGISTRY\A\{d378e567-adf1-2253-e69f-f4985a52b053}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
IsOsComponent
 malicious
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug
ExceptionRecord
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
00184008C5A0EBAC
There are 12 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1377C000
trusted library allocation
page read and write
 malicious
1B2D0000
trusted library section
page read and write
 malicious
12A31000
trusted library allocation
page read and write
 malicious
790000
heap
page read and write
18543D13000
heap
page read and write
AC0000
heap
page read and write
7FF9A54F3000
trusted library allocation
page execute and read and write
AA0000
trusted library allocation
page read and write
D80000
heap
page read and write
A54000
trusted library allocation
page read and write
18543A23000
unkown
page read and write
B37000
heap
page read and write
18543A28000
heap
page read and write
A90000
heap
page execute and read and write
49AB3FE000
stack
page read and write
7FF9A5610000
trusted library allocation
page execute and read and write
7FF9A5500000
trusted library allocation
page read and write
12A23000
trusted library allocation
page read and write
7FF496F40000
trusted library allocation
page execute and read and write
2C0000
unkown
page readonly
1AE8D000
stack
page read and write
A61000
trusted library allocation
page read and write
A51000
trusted library allocation
page read and write
18543A38000
heap
page read and write
AA0000
trusted library allocation
page read and write
12A28000
trusted library allocation
page read and write
18543A02000
unkown
page read and write
18543A0D000
unkown
page read and write
2A3C000
trusted library allocation
page read and write
7D0000
heap
page read and write
7FF9A55A0000
trusted library allocation
page read and write
754000
stack
page read and write
AEC000
heap
page read and write
7FF9A5502000
trusted library allocation
page read and write
B6F000
heap
page read and write
7FF9A5696000
trusted library allocation
page read and write
A20000
trusted library allocation
page read and write
18543A00000
unkown
page read and write
D30000
heap
page read and write
AEE000
heap
page read and write
7FF9A5692000
trusted library allocation
page read and write
7FF9A554C000
trusted library allocation
page execute and read and write
18543B15000
trusted library allocation
page read and write
AE7000
heap
page read and write
185437B0000
trusted library allocation
page read and write
18543B00000
trusted library allocation
page read and write
B49000
heap
page read and write
7B0000
heap
page read and write
18543B02000
trusted library allocation
page read and write
7FF9A55B0000
trusted library allocation
page execute and read and write
F8F000
stack
page read and write
7FF9A54F4000
trusted library allocation
page read and write
AFF000
heap
page read and write
7FF9A5508000
trusted library allocation
page read and write
2C2000
unkown
page readonly
7F0000
heap
page read and write
7FF9A55A6000
trusted library allocation
page read and write
7F5000
heap
page read and write
7FF9A54FD000
trusted library allocation
page execute and read and write
49AB4F9000
stack
page read and write
18543A13000
unkown
page read and write
1B2CF000
stack
page read and write
A70000
trusted library allocation
page read and write
49AADED000
stack
page read and write
E8E000
stack
page read and write
B9A000
heap
page read and write
185437A0000
heap
page read and write
7FF9A5514000
trusted library allocation
page read and write
49AB2FF000
stack
page read and write
A80000
trusted library allocation
page read and write
A90000
trusted library allocation
page read and write
18543A20000
unkown
page read and write
AE4000
heap
page read and write
2C0000
unkown
page readonly
18543B23000
heap
page read and write
7FF9A5510000
trusted library allocation
page read and write
7FF9A551D000
trusted library allocation
page execute and read and write
2A10000
heap
page execute and read and write
B4B000
heap
page read and write
B33000
heap
page read and write
ACC000
heap
page read and write
18543D02000
heap
page read and write
18543C13000
heap
page read and write
7FF9A55D6000
trusted library allocation
page execute and read and write
282E000
stack
page read and write
18543C02000
heap
page read and write
18543D00000
heap
page read and write
12A21000
trusted library allocation
page read and write
620000
heap
page read and write
49AB17F000
stack
page read and write
18543810000
heap
page read and write
AFB000
heap
page read and write
B03000
heap
page read and write
AB0000
trusted library allocation
page read and write
A40000
trusted library allocation
page read and write
A64000
trusted library allocation
page read and write
2A21000
trusted library allocation
page read and write
2890000
heap
page read and write
There are 88 hidden memdumps, click here to show them.