IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_2e03bc4ecf45f112b414c3e3e4088ccb08ed6_7cc2f8af_508b4517-fda8-4f6b-a9de-2f1fbd4af286\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB64E.tmp.dmp
Mini DuMP crash report, 14 streams, Sun Oct 27 16:51:55 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB6BC.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB70B.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 168

URLs

Name
IP
Malicious
http://185.215.113.206/e2b1563c6670f193.php
malicious
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProgramId
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
FileId
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LowerCaseLongPath
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LongPathHash
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Name
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
OriginalFileName
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Publisher
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Version
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinFileVersion
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinaryType
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductName
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductVersion
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LinkDate
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinProductVersion
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageFullName
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageRelativeId
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Size
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Language
 malicious
\REGISTRY\A\{f971ba25-3578-63ca-6d8c-5fb7c69b554f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Usn
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
401000
unkown
page execute and write copy
 malicious
401000
unkown
page execute and write copy
 malicious
41E000
unkown
page read and write
920000
heap
page read and write
65C000
unkown
page readonly
78E000
stack
page read and write
41E000
unkown
page readonly
19E000
stack
page read and write
42B000
unkown
page write copy
8AF000
stack
page read and write
928000
heap
page read and write
41F000
unkown
page readonly
65C000
unkown
page readonly
1F0000
heap
page read and write
7A0000
heap
page read and write
740000
heap
page read and write
400000
unkown
page readonly
9D000
stack
page read and write
92E000
heap
page read and write
400000
unkown
page readonly
42B000
unkown
page write copy
There are 11 hidden memdumps, click here to show them.