IOC Report
rU7laIXI5D.exe

loading gif

Files

File Path
Type
Category
Malicious
rU7laIXI5D.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
initial sample
 malicious
C:\Windows\microsofthelp.exe
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\rU7laIXI5D.exe
"C:\Users\user\Desktop\rU7laIXI5D.exe"
 malicious
C:\Windows\microsofthelp.exe
"C:\Windows\microsofthelp.exe"
 malicious

Domains

Name
IP
Malicious
s-part-0017.t-0009.t-msedge.net
13.107.246.45

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
microsofthelp
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
401000
unkown
page execute and write copy
 malicious
406000
unkown
page execute and write copy
 malicious
406000
unkown
page execute and write copy
 malicious
401000
unkown
page execute and write copy
 malicious
4C8000
heap
page read and write
 malicious
40C000
unkown
page write copy
408000
unkown
page execute and read and write
5D0000
heap
page read and write
401000
unkown
page execute and write copy
410000
heap
page read and write
8BF000
stack
page read and write
410000
heap
page read and write
19D000
stack
page read and write
405000
unkown
page execute and read and write
408000
unkown
page execute and read and write
9C000
stack
page read and write
4D6000
heap
page read and write
400000
unkown
page readonly
40C000
unkown
page read and write
40C000
unkown
page write copy
408000
unkown
page execute and write copy
480000
heap
page read and write
1F0000
heap
page read and write
AB0000
heap
page read and write
400000
unkown
page readonly
400000
unkown
page readonly
409000
unkown
page execute and write copy
9C000
stack
page read and write
19D000
stack
page read and write
1F0000
heap
page read and write
7BE000
stack
page read and write
408000
unkown
page execute and write copy
400000
unkown
page readonly
4B0000
heap
page read and write
77F000
stack
page read and write
401000
unkown
page execute and write copy
4BA000
heap
page read and write
45E000
stack
page read and write
405000
unkown
page execute and read and write
4BE000
heap
page read and write
9B0000
heap
page read and write
40C000
unkown
page read and write
5DA000
heap
page read and write
5E8000
heap
page read and write
409000
unkown
page execute and write copy
4C0000
heap
page read and write
5DE000
heap
page read and write
There are 37 hidden memdumps, click here to show them.