IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_71e4f97fcad7bd8af59197fe7fdb89b6f66cc6a_89969336_9d5f8a6b-4665-44cb-89ec-0ff41a3c22d9\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5517.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Sep 30 13:58:04 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5585.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER55C5.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6644 -s 508

URLs

Name
IP
Malicious
https://www.abyssmedia.com
unknown
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProgramId
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
FileId
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LowerCaseLongPath
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LongPathHash
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Name
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
OriginalFileName
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Publisher
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Version
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinFileVersion
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinaryType
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductName
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductVersion
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LinkDate
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinProductVersion
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageFullName
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageRelativeId
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Size
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Language
 malicious
\REGISTRY\A\{a7c1fe07-a732-a983-45df-a6e3cbff0f3f}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Usn
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
9F9000
direct allocation
page read and write
450000
unkown
page write copy
6CE000
stack
page read and write
44E000
unkown
page read and write
A08000
direct allocation
page read and write
1F0000
heap
page read and write
460000
heap
page read and write
A33000
direct allocation
page read and write
454000
unkown
page readonly
A41000
direct allocation
page read and write
A3A000
direct allocation
page read and write
4A0000
heap
page read and write
A90000
heap
page read and write
9DC000
direct allocation
page read and write
436000
unkown
page read and write
4C0000
heap
page read and write
A2C000
direct allocation
page read and write
435000
unkown
page write copy
9F2000
direct allocation
page read and write
19D000
stack
page read and write
4C8000
heap
page read and write
4CE000
heap
page read and write
433000
unkown
page read and write
A1D000
direct allocation
page read and write
90F000
stack
page read and write
400000
unkown
page readonly
A0F000
direct allocation
page read and write
7CF000
stack
page read and write
9EB000
direct allocation
page read and write
A24000
direct allocation
page read and write
400000
unkown
page readonly
44F000
unkown
page write copy
401000
unkown
page execute read
454000
unkown
page readonly
80E000
stack
page read and write
9E4000
direct allocation
page read and write
A48000
direct allocation
page read and write
451000
unkown
page read and write
401000
unkown
page execute read
433000
unkown
page write copy
9C000
stack
page read and write
A16000
direct allocation
page read and write
There are 32 hidden memdumps, click here to show them.