IOC Report
DRAWING_SHEET_P02405912916 .exe

loading gif

Files

File Path
Type
Category
Malicious
DRAWING_SHEET_P02405912916 .exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_DRAWING_SHEET_P0_b088b2a1ea814e2a8d34d4abad448ba01bd6d55_a0fac049_8c9e2797-37ac-4a2f-8c4c-14b00a3cae93\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8A7.tmp.dmp
Mini DuMP crash report, 16 streams, Mon May 27 10:26:35 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9E0.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA10.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe
"C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4028 -s 1016

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
 malicious
https://api.ipify.org
unknown
http://upx.sf.net
unknown
http://mail.officeemailbackup.com
unknown
https://sectigo.com/CPS0
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://officeemailbackup.com
unknown

Domains

Name
IP
Malicious
officeemailbackup.com
179.43.183.46
 malicious
api.ipify.org
172.67.74.152
 malicious
mail.officeemailbackup.com
unknown
 malicious
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
179.43.183.46
officeemailbackup.com
Panama
malicious
172.67.74.152
api.ipify.org
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\msbuild_RASMANCS
FileDirectory
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
ProgramId
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
FileId
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
LowerCaseLongPath
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
LongPathHash
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
Name
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
OriginalFileName
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
Publisher
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
Version
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
BinFileVersion
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
BinaryType
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
ProductName
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
ProductVersion
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
LinkDate
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
BinProductVersion
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
AppxPackageFullName
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
AppxPackageRelativeId
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
Size
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
Language
\REGISTRY\A\{d244e630-be26-66a0-b388-4b6f83627edb}\Root\InventoryApplicationFile\drawing_sheet_p0|83122db914e787e4
Usn
There are 24 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2D9C000
trusted library allocation
page read and write
 malicious
1DFDB0E7000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
2DA4000
trusted library allocation
page read and write
 malicious
2D71000
trusted library allocation
page read and write
 malicious
1DFCB43B000
trusted library allocation
page read and write
 malicious
13DD000
trusted library allocation
page execute and read and write
CF9000
stack
page read and write
1DFCB13D000
trusted library allocation
page read and write
661E000
stack
page read and write
64D9000
trusted library allocation
page read and write
569E000
stack
page read and write
5160000
heap
page read and write
1DFC9636000
heap
page read and write
793AFFE000
stack
page read and write
13EA000
trusted library allocation
page execute and read and write
2D57000
trusted library allocation
page read and write
579F000
stack
page read and write
6690000
trusted library allocation
page read and write
1DFC9594000
heap
page read and write
2DBC000
trusted library allocation
page read and write
2D21000
trusted library allocation
page read and write
2C28000
trusted library allocation
page read and write
6640000
trusted library allocation
page read and write
66B0000
trusted library allocation
page execute and read and write
66A0000
trusted library allocation
page read and write
FF590000
trusted library allocation
page execute and read and write
7FFB4B270000
trusted library allocation
page read and write
793B6FD000
stack
page read and write
1077000
heap
page read and write
2AD0000
trusted library allocation
page read and write
7FFB4B14C000
trusted library allocation
page execute and read and write
1DFC95BB000
heap
page read and write
651E000
stack
page read and write
1DFC9591000
heap
page read and write
5354000
heap
page read and write
1DFC93A0000
heap
page read and write
2B00000
trusted library allocation
page read and write
7FFB4B280000
trusted library allocation
page read and write
2CED000
trusted library allocation
page read and write
1410000
trusted library allocation
page read and write
1035000
heap
page read and write
400000
remote allocation
page execute and read and write
10A7000
heap
page read and write
1DFC958E000
heap
page read and write
7FFB4B2B0000
trusted library allocation
page read and write
13F5000
trusted library allocation
page execute and read and write
6DC0000
heap
page read and write
5EE1000
heap
page read and write
2D5F000
trusted library allocation
page read and write
1DFC9480000
heap
page read and write
793AB33000
stack
page read and write
555E000
stack
page read and write
FF3000
trusted library allocation
page execute and read and write
7FFB4B0BD000
trusted library allocation
page execute and read and write
7FFB4B090000
trusted library allocation
page read and write
FF0000
trusted library allocation
page read and write
1436000
heap
page read and write
1DFC92F2000
unkown
page readonly
1000000
heap
page read and write
7FFB4B230000
trusted library allocation
page read and write
6B30000
trusted library allocation
page read and write
13F2000
trusted library allocation
page read and write
7FFB4B0EC000
trusted library allocation
page execute and read and write
7FFB4B250000
trusted library allocation
page read and write
1430000
heap
page read and write
1DFC9935000
heap
page read and write
E55000
heap
page read and write
7FFB4B249000
trusted library allocation
page read and write
1DFC98C0000
heap
page execute and read and write
7FFB4B290000
trusted library allocation
page read and write
1DFC97A5000
heap
page read and write
793B2FC000
stack
page read and write
1DFC94A0000
heap
page read and write
1DFDB0E1000
trusted library allocation
page read and write
7FFB4B150000
trusted library allocation
page execute and read and write
2B10000
heap
page read and write
D40000
heap
page read and write
1038000
heap
page read and write
2CE1000
trusted library allocation
page read and write
545C000
stack
page read and write
7FFB4B1B0000
trusted library allocation
page execute and read and write
1DFE37A0000
heap
page read and write
7FFB4B140000
trusted library allocation
page read and write
7FFB4B0A0000
trusted library allocation
page read and write
7FFB4B240000
trusted library allocation
page read and write
1DFC95BD000
heap
page read and write
2ACC000
stack
page read and write
6B50000
heap
page read and write
7FFB4B2A0000
trusted library allocation
page execute and read and write
64BD000
stack
page read and write
668D000
stack
page read and write
13E0000
trusted library allocation
page read and write
7FF4AA0F0000
trusted library allocation
page execute and read and write
6B0D000
stack
page read and write
1DFC955C000
heap
page read and write
674E000
stack
page read and write
FE0000
trusted library allocation
page read and write
6A0E000
stack
page read and write
67AB000
trusted library allocation
page read and write
6630000
trusted library allocation
page read and write
1DFC95C7000
heap
page read and write
793B4FE000
stack
page read and write
13E6000
trusted library allocation
page execute and read and write
E20000
heap
page read and write
3D21000
trusted library allocation
page read and write
7FFB4B094000
trusted library allocation
page read and write
7FFB4B0B0000
trusted library allocation
page read and write
FF4000
trusted library allocation
page read and write
13F0000
trusted library allocation
page read and write
637E000
stack
page read and write
793B1FF000
stack
page read and write
64D0000
trusted library allocation
page read and write
1420000
trusted library allocation
page execute and read and write
7FFB4B23A000
trusted library allocation
page read and write
FFD000
trusted library allocation
page execute and read and write
2D10000
heap
page execute and read and write
2CDE000
trusted library allocation
page read and write
7FFB4B176000
trusted library allocation
page execute and read and write
67A0000
trusted library allocation
page read and write
11FE000
stack
page read and write
1DFC9530000
trusted library allocation
page read and write
1097000
heap
page read and write
13F7000
trusted library allocation
page execute and read and write
4E1E000
stack
page read and write
5ECC000
heap
page read and write
7FFB4B24E000
trusted library allocation
page read and write
793B0FF000
stack
page read and write
530E000
stack
page read and write
E9E000
stack
page read and write
EA0000
heap
page read and write
5350000
heap
page read and write
7FFB4B0AD000
trusted library allocation
page execute and read and write
F5E000
stack
page read and write
2D6D000
trusted library allocation
page read and write
793AEFE000
stack
page read and write
2DB0000
trusted library allocation
page read and write
7FFB4B288000
trusted library allocation
page read and write
1DFC9597000
heap
page read and write
6B40000
trusted library allocation
page execute and read and write
793B5FE000
stack
page read and write
1DFC9680000
heap
page execute and read and write
6697000
trusted library allocation
page read and write
9DA000
stack
page read and write
13FB000
trusted library allocation
page execute and read and write
6790000
trusted library allocation
page execute and read and write
7FFB4B09D000
trusted library allocation
page execute and read and write
ED0000
heap
page read and write
1DFC92F0000
unkown
page readonly
529C000
stack
page read and write
5F0B000
heap
page read and write
6647000
trusted library allocation
page read and write
F1E000
stack
page read and write
793B3FE000
stack
page read and write
52C0000
heap
page execute and read and write
565E000
stack
page read and write
5EC0000
heap
page read and write
10AB000
heap
page read and write
63BE000
stack
page read and write
7FFB4B0BB000
trusted library allocation
page execute and read and write
5EC8000
heap
page read and write
7FFB4B260000
trusted library allocation
page read and write
1DFC9550000
heap
page read and write
13E2000
trusted library allocation
page read and write
678E000
stack
page read and write
7FFB4B146000
trusted library allocation
page read and write
2AE0000
trusted library allocation
page read and write
2CCB000
trusted library allocation
page read and write
1DFE37E1000
heap
page read and write
2CCE000
trusted library allocation
page read and write
2CD2000
trusted library allocation
page read and write
7FFB4B092000
trusted library allocation
page read and write
2A8E000
stack
page read and write
64C0000
heap
page read and write
1DFC9930000
heap
page read and write
3D87000
trusted library allocation
page read and write
1DFC97A0000
heap
page read and write
3D49000
trusted library allocation
page read and write
13D0000
trusted library allocation
page read and write
1DFC9670000
trusted library section
page read and write
663D000
trusted library allocation
page read and write
2CE6000
trusted library allocation
page read and write
1008000
heap
page read and write
2D9A000
trusted library allocation
page read and write
2D96000
trusted library allocation
page read and write
627D000
stack
page read and write
7FFB4B093000
trusted library allocation
page execute and read and write
E50000
heap
page read and write
534D000
stack
page read and write
1DFC9710000
trusted library section
page read and write
1DFCB0E1000
trusted library allocation
page read and write
10D1000
heap
page read and write
5F67000
heap
page read and write
1DFC9540000
trusted library allocation
page read and write
5F71000
heap
page read and write
7FFB4B0B4000
trusted library allocation
page read and write
694E000
stack
page read and write
1DFC94C0000
heap
page read and write
1DFC9690000
heap
page read and write
1DFC9543000
trusted library allocation
page read and write
1DFC9510000
trusted library allocation
page read and write
2CC0000
trusted library allocation
page read and write
1DFE3110000
trusted library allocation
page read and write
2AF0000
trusted library allocation
page read and write
1DFC932A000
unkown
page readonly
1DFC9579000
heap
page read and write
2C1F000
stack
page read and write
There are 197 hidden memdumps, click here to show them.