IOC Report
Invoices AMM Consol 020-04860612.exe

loading gif

Files

File Path
Type
Category
Malicious
Invoices AMM Consol 020-04860612.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Invoices AMM Consol 020-04860612.exe.log
CSV text
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Invoices AMM Consol 020-04860612.exe
"C:\Users\user\Desktop\Invoices AMM Consol 020-04860612.exe"
 malicious
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 6900 -s 12

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
time.windows.com
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
7FFAACBAD000
trusted library allocation
page execute and read and write
1DB1F000
stack
page read and write
1690000
heap
page read and write
7FFB1E3C5000
unkown
page readonly
41FB000
trusted library allocation
page read and write
1C8E000
stack
page read and write
7FFAACD42000
trusted library allocation
page read and write
DB0000
unkown
page readonly
4223000
trusted library allocation
page read and write
1CDE0000
heap
page read and write
248E000
stack
page read and write
1D71F000
stack
page read and write
1CC70000
heap
page read and write
FB0000
heap
page read and write
1C180000
trusted library allocation
page read and write
1426B000
trusted library allocation
page read and write
7FFB1E3C0000
unkown
page read and write
1CF10000
heap
page read and write
1660000
heap
page execute and read and write
7FFAACBB0000
trusted library allocation
page read and write
172D000
heap
page read and write
7FFAACC5C000
trusted library allocation
page execute and read and write
7FFAACDB0000
trusted library allocation
page read and write
14158000
trusted library allocation
page read and write
7FFAACD7B000
trusted library allocation
page read and write
414E000
stack
page read and write
1F620000
heap
page read and write
7FFB1E3C2000
unkown
page readonly
16C9000
heap
page read and write
208F000
stack
page read and write
7FFAACBA0000
trusted library allocation
page read and write
4228000
trusted library allocation
page read and write
3C38000
heap
page read and write
7FFAACD80000
trusted library allocation
page execute and read and write
1CD80000
trusted library section
page read and write
7FFB1E3A0000
unkown
page readonly
7FFAACCC0000
trusted library allocation
page execute and read and write
FE0000
heap
page read and write
7FFAACBBD000
trusted library allocation
page execute and read and write
1F7F0000
trusted library section
page read and write
1CC10000
trusted library section
page readonly
200BE000
stack
page read and write
F70000
heap
page read and write
3D49000
heap
page read and write
1701000
heap
page read and write
FA5000
heap
page read and write
15EE000
stack
page read and write
1CEE0000
trusted library section
page read and write
14355000
trusted library allocation
page read and write
7FFAACBA4000
trusted library allocation
page read and write
F40000
heap
page read and write
1600000
trusted library allocation
page read and write
7FFAACBFC000
trusted library allocation
page execute and read and write
1FCBE000
stack
page read and write
FE5000
heap
page read and write
3D40000
heap
page read and write
7FFAACBC0000
trusted library allocation
page read and write
1CEF0000
trusted library allocation
page read and write
41F9000
trusted library allocation
page read and write
1CCF0000
heap
page execute and read and write
1703000
heap
page read and write
7FFAACBCB000
trusted library allocation
page execute and read and write
7FFAACBCD000
trusted library allocation
page execute and read and write
7FFAACD90000
trusted library allocation
page read and write
7FFB1E3A1000
unkown
page execute read
16C0000
heap
page read and write
420C000
trusted library allocation
page read and write
7FFAACBC4000
trusted library allocation
page read and write
7FFAACD50000
trusted library allocation
page read and write
DB2000
unkown
page readonly
1620000
trusted library allocation
page read and write
7FFAACDA0000
trusted library allocation
page read and write
7FFAACC56000
trusted library allocation
page read and write
14151000
trusted library allocation
page read and write
7FF443640000
trusted library allocation
page execute and read and write
1CC20000
heap
page read and write
7FFAACD70000
trusted library allocation
page read and write
7FFAACD60000
trusted library allocation
page execute and read and write
1F120000
heap
page read and write
1DF30000
heap
page read and write
7FFAACBA3000
trusted library allocation
page execute and read and write
1CC76000
heap
page read and write
7FFAACC50000
trusted library allocation
page read and write
1C8CC000
stack
page read and write
1CDA0000
trusted library section
page read and write
41EC000
trusted library allocation
page read and write
1F020000
heap
page read and write
FA0000
heap
page read and write
1733000
heap
page read and write
7FFB1E3B6000
unkown
page readonly
1CDE3000
heap
page read and write
1CDC0000
heap
page read and write
7FFAACD78000
trusted library allocation
page read and write
7FFAACC60000
trusted library allocation
page execute and read and write
7FFAACBB3000
trusted library allocation
page read and write
1DF1F000
stack
page read and write
7FFAACD40000
trusted library allocation
page read and write
1D31C000
stack
page read and write
1DF20000
heap
page read and write
4151000
trusted library allocation
page read and write
14161000
trusted library allocation
page read and write
7FFAACC86000
trusted library allocation
page execute and read and write
F50000
heap
page read and write
16EB000
heap
page read and write
BC781FC000
stack
page read and write
There are 95 hidden memdumps, click here to show them.