IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_f474d7ace939a34cc5b3cdfa86976697e4a181ee_ce8703b6_e31620dd-330d-450a-b53a-41b59fb426cf\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER300C.tmp.dmp
Mini DuMP crash report, 15 streams, Wed Aug 28 16:57:33 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3126.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3146.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 876

URLs

Name
IP
Malicious
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
unknown
http://upx.sf.net
unknown
https://sectigo.com/CPS0
unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
unknown
https://aka.ms/dotnet-warnings/
unknown
http://ocsp.sectigo.com0
unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
ProgramId
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
FileId
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
LowerCaseLongPath
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
LongPathHash
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Name
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
OriginalFileName
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Publisher
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Version
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
BinFileVersion
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
BinaryType
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
ProductName
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
ProductVersion
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
LinkDate
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
BinProductVersion
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
AppxPackageFullName
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
AppxPackageRelativeId
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Size
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Language
 malicious
\REGISTRY\A\{12dc126a-23af-a25c-dd5e-71120ab4706d}\Root\InventoryApplicationFile\file.exe|5c6ea74fda3dfec0
Usn
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018000DDABBE6B3
There are 13 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1CEF000
stack
page read and write
3597000
trusted library allocation
page read and write
19A5000
heap
page read and write
19F2000
heap
page read and write
1920000
trusted library allocation
page read and write
19E4000
heap
page read and write
1B70000
trusted library allocation
page read and write
1978000
heap
page read and write
13FB000
stack
page read and write
35A0000
trusted library allocation
page read and write
35AB000
trusted library allocation
page read and write
3580000
trusted library allocation
page execute and read and write
1A0C000
heap
page read and write
193A000
trusted library allocation
page read and write
37BE000
stack
page read and write
197E000
heap
page read and write
1760000
heap
page read and write
359C000
trusted library allocation
page read and write
1BE0000
heap
page read and write
3591000
trusted library allocation
page read and write
1BBE000
stack
page read and write
3660000
heap
page read and write
58EE000
stack
page read and write
376E000
stack
page read and write
12EC000
unkown
page readonly
638E000
stack
page read and write
35B0000
trusted library allocation
page read and write
618E000
stack
page read and write
1934000
trusted library allocation
page read and write
192D000
trusted library allocation
page execute and read and write
F00000
unkown
page readonly
35D0000
trusted library allocation
page read and write
5F90000
heap
page read and write
3650000
heap
page read and write
18FE000
stack
page read and write
19B4000
heap
page read and write
F02000
unkown
page readonly
188D000
stack
page read and write
5CAE000
stack
page read and write
1BC0000
heap
page read and write
1840000
heap
page read and write
47F1000
trusted library allocation
page read and write
12EE000
unkown
page readonly
1957000
trusted library allocation
page execute and read and write
1936000
trusted library allocation
page read and write
47F5000
trusted library allocation
page read and write
1923000
trusted library allocation
page execute and read and write
628F000
stack
page read and write
195B000
trusted library allocation
page execute and read and write
5C6E000
stack
page read and write
5F80000
heap
page execute and read and write
1924000
trusted library allocation
page read and write
1910000
trusted library allocation
page read and write
18B0000
heap
page read and write
3770000
trusted library allocation
page execute and read and write
1DD0000
heap
page read and write
1DCE000
stack
page read and write
1970000
heap
page read and write
1950000
trusted library allocation
page read and write
5D80000
heap
page read and write
37F1000
trusted library allocation
page read and write
199C000
heap
page read and write
16F8000
stack
page read and write
18B5000
heap
page read and write
366A000
heap
page read and write
1B6F000
stack
page read and write
35C0000
trusted library allocation
page read and write
37E0000
heap
page execute and read and write
There are 58 hidden memdumps, click here to show them.