Windows Analysis Report
PI No 20000814C.exe

Overview

General Information

Sample name:	PI No 20000814C.exe
Analysis ID:	1447909
MD5:	2c40af3164c197806fcf499a1e6a0b85
SHA1:	4bb49ffbbaa20503615a610b579a2c8dacb21fdd
SHA256:	e29923d4e3fa5b30614a263828db410b0ab5c452a4237c8ae33a21ffaaf73cc4
Tags:	exe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Found potential string decryption / allocating functions

One or more processes crash

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: PI No 20000814C.exe	ReversingLabs: Detection: 83%
Source: PI No 20000814C.exe	Virustotal: Detection: 44%			Perma Link

Machine Learning detection for sample

Source: PI No 20000814C.exe

Joe Sandbox ML: detected

Uses 32bit PE files

Source: PI No 20000814C.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

System Summary

Binary is likely a compiled AutoIt script file

Source: PI No 20000814C.exe, 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_cd5e12e4-c
Source: PI No 20000814C.exe, 00000000.00000002.1680273338.0000000000ED5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1d421492-2
Source: PI No 20000814C.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_36205f92-4
Source: PI No 20000814C.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_bf092c20-0

Detected potential crypto function

Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E2E060	0_2_00E2E060
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00EA804A	0_2_00EA804A
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E34140	0_2_00E34140
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E42405	0_2_00E42405
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E56522	0_2_00E56522
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00EA0665	0_2_00EA0665
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E5267E	0_2_00E5267E
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E36843	0_2_00E36843
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E4283A	0_2_00E4283A
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E2E800	0_2_00E2E800
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E589DF	0_2_00E589DF
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00EA0AE2	0_2_00EA0AE2
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E56A94	0_2_00E56A94
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E7EB07	0_2_00E7EB07
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E88B13	0_2_00E88B13
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E4CD61	0_2_00E4CD61
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E57006	0_2_00E57006
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E33190	0_2_00E33190
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E3710E	0_2_00E3710E
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E21287	0_2_00E21287
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E433C7	0_2_00E433C7
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E4F419	0_2_00E4F419
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E416C4	0_2_00E416C4
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E35680	0_2_00E35680
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E358C0	0_2_00E358C0
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E478D3	0_2_00E478D3
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E4DBB5	0_2_00E4DBB5
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E41BB8	0_2_00E41BB8
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E59D05	0_2_00E59D05
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E2FE40	0_2_00E2FE40
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E4BFE6	0_2_00E4BFE6
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E41FD0	0_2_00E41FD0

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: String function: 00E48B40 appears 42 times
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: String function: 00E29BF8 appears 35 times
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: String function: 00E29A20 appears 34 times

One or more processes crash

Source: C:\Users\user\Desktop\PI No 20000814C.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 532

Uses 32bit PE files

Source: PI No 20000814C.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2336

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\1c1557c6-06f6-4845-aeb6-5f246b84e61c

Jump to behavior

Source: PI No 20000814C.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PI No 20000814C.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PI No 20000814C.exe	ReversingLabs: Detection: 83%
Source: PI No 20000814C.exe	Virustotal: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\PI No 20000814C.exe "C:\Users\user\Desktop\PI No 20000814C.exe"
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 532

Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Section loaded: wsock32.dll	Jump to behavior

Source: PI No 20000814C.exe

Static file information: File size 1173504 > 1048576

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E2C588 push eax; retn 0040h		0_2_00E2C599
Source: C:\Users\user\Desktop\PI No 20000814C.exe	Code function: 0_2_00E48B85 push ecx; ret		0_2_00E48B98

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\PI No 20000814C.exe

Process queried: DebugPort

Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\PI No 20000814C.exe

Code function: 0_2_00E4800A ___security_init_cookie,LdrInitializeThunk,

0_2_00E4800A

Source: PI No 20000814C.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\PI No 20000814C.exe

Code function: 0_2_00E4886B cpuid

0_2_00E4886B

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1447909
Product:	CloudBasic
Start time:	12:18:16
Start date:	27.05.2024
Sample:	PI No 20000814C.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	2c40af3164c197806fcf499a1e6a0b85
SHA1:	4bb49ffbbaa20503615a610b579a2c8dacb21fdd
SHA256:	e29923d4e3fa5b30614a263828db410b0ab5c452a4237c8ae33a21ffaaf73cc4
Filetype:	Win32 Executable (generic) a (10002005/4) 99.70%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PI No 20000814C._a57618b41515ff9a6eee1ffe6c8e07652c9a3_194af5ac_d6ddeb29-df61-48d3-b221-d18d1e03fe73\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	F3A90B5C66C7EDFB6AA7E4CDF25ABDE9	7D6AA22D9DBF1126347E245E08AC2DDB0A1D88F1	5A1544DD7DED2C3698A6A90CE54C0C4A3EE9157D24B233F17FF37CC3DF98BCC7
C:\ProgramData\Microsoft\Windows\WER\Temp\WERACA6.tmp.dmp	Mini DuMP crash report, 14 streams, Mon May 27 10:19:37 2024, 0x1205a4 type	060B7BD08336F805AD6BDD02E9C837E5	E1FBD133638557B6EC98C968B3554921A7B32FFB	4862DC013417ED351738BCD3BD1DFAC0A6A87821B29EAA604B65AF9BBFD78DA0
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD53.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	AC3935353B6735432F5F84B922DA40A2	BA1F4E2E6773BED81BF383BDAF15BCAA192D0D4A	2F319EE01FFE977128002CE42BFCFF449ED6BF63BE2C5D61DC910A4B720E791E
C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD73.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	82315993FCC354665C6BC83CFF579D31	B5B4461D95BF8E8AFC88F8AC72422CFB870DFEC3	3C6E3A07D9C3299E8F49370E766E189E189D034E3DE209E0D5703FBD8349630E
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	FCBC04893C838357C177EA96D64182A4	8335089D95FD2629BB3C84DA9421BF7A42CA2218	95953EE3BFF041FB075CF95A31ED3612288913D945FC08A90DDDF3337169CA56

Windows Analysis Report
PI No 20000814C.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report PI No 20000814C.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
PI No 20000814C.exe