IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_d2892c472895a2b98efdcdcd7642ab4d7ea6c2_3b20dbdc_17059a9d\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C19.tmp.dmp
Mini DuMP crash report, 15 streams, Wed Jun 7 00:22:17 2023, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E1E.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7E4D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
C:\Users\user\Desktop\file.exe
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3360 -s 944

URLs

Name
IP
Malicious
http://upx.sf.net
unknown

IPs

IP
Domain
Country
Malicious
192.168.2.1
unknown
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
ProgramId
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
FileId
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
LowerCaseLongPath
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
LongPathHash
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
Name
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
Publisher
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
Version
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
BinFileVersion
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
BinaryType
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
ProductName
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
ProductVersion
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
LinkDate
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
BinProductVersion
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
Size
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
Language
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
IsPeFile
 malicious
\REGISTRY\A\{a10d5d40-de29-ad1b-d8c4-b12ef076432c}\Root\InventoryApplicationFile\file.exe|4de4a562939a1599
IsOsComponent
 malicious
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Property
0018C0095B5F3F09
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug
ExceptionRecord
There are 12 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
13EBC000
trusted library allocation
page read and write
 malicious
1BC10000
trusted library section
page read and write
 malicious
13171000
trusted library allocation
page read and write
 malicious
17774CD0000
trusted library allocation
page read and write
128F000
heap
page read and write
17774C0F000
heap
page read and write
7FFBABFD4000
trusted library allocation
page read and write
E70000
heap
page read and write
1D81CA13000
unkown
page read and write
17774CE0000
trusted library allocation
page read and write
35D7B7E000
stack
page read and write
7FFBABFF4000
trusted library allocation
page read and write
17774D40000
trusted library allocation
page read and write
35D7D7D000
stack
page read and write
2F31000
trusted library allocation
page read and write
178F000
stack
page read and write
35D7AFE000
stack
page read and write
7FFBABFE2000
trusted library allocation
page read and write
17774D80000
heap
page read and write
152F000
stack
page read and write
17775740000
trusted library allocation
page read and write
17774D85000
heap
page read and write
1279000
heap
page read and write
7FFBAC086000
trusted library allocation
page read and write
25977FF000
stack
page read and write
1D81CC13000
heap
page read and write
13161000
trusted library allocation
page read and write
1D81CD02000
heap
page read and write
35D7CFE000
stack
page read and write
2F80000
trusted library allocation
page read and write
168F000
stack
page read and write
B00000
unkown
page readonly
12C8000
heap
page read and write
12CA000
heap
page read and write
317C000
trusted library allocation
page read and write
17775970000
trusted library allocation
page read and write
126C000
heap
page read and write
2F40000
trusted library allocation
page read and write
7FFBAC176000
trusted library allocation
page read and write
1260000
heap
page read and write
1BC00000
heap
page read and write
1585000
heap
page read and write
7FFBAC090000
trusted library allocation
page execute and read and write
7FFBABFE0000
trusted library allocation
page read and write
1D81C8E0000
heap
page read and write
1B6DD000
stack
page read and write
17774C07000
heap
page read and write
129F000
heap
page read and write
1317000
heap
page read and write
3020000
heap
page execute and read and write
17774A00000
heap
page read and write
17774BC9000
heap
page read and write
7FFBAC080000
trusted library allocation
page read and write
7FFBABFE8000
trusted library allocation
page read and write
FE0000
heap
page read and write
3050000
heap
page read and write
2F60000
trusted library allocation
page read and write
25978FE000
stack
page read and write
1D81CA21000
unkown
page read and write
1530000
heap
page read and write
1580000
heap
page read and write
17774C0F000
heap
page read and write
1D81CD00000
heap
page read and write
7FFBAC0F0000
trusted library allocation
page execute and read and write
1D81CA24000
unkown
page read and write
B00000
unkown
page readonly
17775980000
trusted library allocation
page read and write
1200000
heap
page read and write
1D81CA02000
unkown
page read and write
1560000
trusted library allocation
page read and write
1220000
heap
page read and write
1D81CB02000
trusted library allocation
page read and write
13168000
trusted library allocation
page read and write
25979FE000
stack
page read and write
35D7A7E000
stack
page read and write
1D81CD13000
heap
page read and write
1D81CB00000
trusted library allocation
page read and write
2F34000
trusted library allocation
page read and write
1574000
trusted library allocation
page read and write
1D81CA46000
heap
page read and write
1D81CB15000
trusted library allocation
page read and write
177759D0000
trusted library allocation
page read and write
1D81C880000
trusted library allocation
page read and write
2F70000
trusted library allocation
page read and write
2F50000
trusted library allocation
page read and write
13163000
trusted library allocation
page read and write
1D81C870000
heap
page read and write
17774C24000
heap
page read and write
17774D89000
heap
page read and write
1D81CA49000
heap
page read and write
17774D90000
trusted library allocation
page read and write
7FFBABFFD000
trusted library allocation
page execute and read and write
25973CD000
stack
page read and write
17775950000
trusted library allocation
page read and write
7FF4CF570000
trusted library allocation
page execute and read and write
3161000
trusted library allocation
page read and write
17774BC0000
heap
page read and write
1D81CA0F000
unkown
page read and write
2F60000
trusted library allocation
page read and write
1BBB0000
heap
page execute and read and write
1D81CB23000
heap
page read and write
35D7BF9000
stack
page read and write
17775960000
heap
page readonly
1571000
trusted library allocation
page read and write
17774A10000
trusted library allocation
page read and write
17774B60000
heap
page read and write
1D81CA00000
unkown
page read and write
1D81CC02000
heap
page read and write
1540000
trusted library allocation
page read and write
7FFBAC02C000
trusted library allocation
page execute and read and write
7FFBAC172000
trusted library allocation
page read and write
2597AF9000
stack
page read and write
FA4000
stack
page read and write
17774C0F000
heap
page read and write
7FFBABFDD000
trusted library allocation
page execute and read and write
35D77AB000
stack
page read and write
128D000
heap
page read and write
17774B40000
heap
page read and write
35D7C79000
stack
page read and write
B02000
unkown
page readonly
7FFBAC0B6000
trusted library allocation
page execute and read and write
7FFBABFF0000
trusted library allocation
page read and write
7FFBABFD3000
trusted library allocation
page execute and read and write
129C000
heap
page read and write
315F000
stack
page read and write
There are 115 hidden memdumps, click here to show them.