IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_2c15e17febf675b7e661e8453137d737bfe89f3e_97d693c2_588b9f29-069a-480e-bb78-6b12b5d4d4c2\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F64.tmp.dmp
Mini DuMP crash report, 16 streams, Mon Sep 30 14:08:59 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4040.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER409F.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2656 -s 908

URLs

Name
IP
Malicious
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProgramId
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
FileId
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LowerCaseLongPath
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LongPathHash
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Name
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
OriginalFileName
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Publisher
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Version
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinFileVersion
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinaryType
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductName
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
ProductVersion
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
LinkDate
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
BinProductVersion
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageFullName
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
AppxPackageRelativeId
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Size
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Language
 malicious
\REGISTRY\A\{a09a968c-4c5a-66b5-cb80-6d90330e4d5a}\Root\InventoryApplicationFile\file.exe|ff8e65d6b06db8e5
Usn
 malicious
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
62000
unkown
page readonly
 malicious
160000
heap
page read and write
558000
heap
page read and write
7FF40D670000
trusted library allocation
page execute and read and write
12371000
trusted library allocation
page read and write
7FFD9B76D000
trusted library allocation
page execute and read and write
599000
heap
page read and write
7FFD9B764000
trusted library allocation
page read and write
235E000
stack
page read and write
1A0000
heap
page read and write
2360000
heap
page read and write
ABE000
stack
page read and write
2371000
trusted library allocation
page read and write
590000
heap
page read and write
9BE000
stack
page read and write
1A8FD000
stack
page read and write
7FFD9B763000
trusted library allocation
page execute and read and write
53F000
heap
page read and write
150000
heap
page read and write
1AF4F000
stack
page read and write
7FFD9B777000
trusted library allocation
page read and write
60000
unkown
page readonly
60000
unkown
page readonly
1AE4E000
stack
page read and write
7B5000
heap
page read and write
740000
heap
page read and write
BE000
unkown
page readonly
700000
heap
page execute and read and write
597000
heap
page read and write
7FFD9B880000
trusted library allocation
page execute and read and write
52C000
heap
page read and write
510000
trusted library allocation
page read and write
1AD3E000
stack
page read and write
180000
heap
page read and write
755000
heap
page read and write
7FFD9B810000
trusted library allocation
page read and write
550000
heap
page read and write
7FFD9B770000
trusted library allocation
page read and write
8BE000
stack
page read and write
555000
heap
page read and write
6F0000
trusted library allocation
page read and write
7FFD9B846000
trusted library allocation
page execute and read and write
1F0000
trusted library allocation
page read and write
7FFD9B900000
trusted library allocation
page read and write
58E000
heap
page read and write
54C000
heap
page read and write
561000
heap
page read and write
4F5000
stack
page read and write
7B0000
heap
page read and write
526000
heap
page read and write
750000
heap
page read and write
6F3000
trusted library allocation
page read and write
12373000
trusted library allocation
page read and write
1AD40000
heap
page execute and read and write
520000
heap
page read and write
7FFD9B820000
trusted library allocation
page execute and read and write
7FFD9B773000
trusted library allocation
page read and write
564000
heap
page read and write
There are 48 hidden memdumps, click here to show them.