IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_b7ec1b37f5bdf9de2faad2aaaca2b15765533cd8_02bbd8d5_5f6ab712-a5ae-4c3e-8d69-92f3de4241c6\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB203.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Sep 30 14:18:53 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB232.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERB262.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 224

URLs

Name
IP
Malicious
http://upx.sf.net
unknown
http://ip-api.com/json
unknown
https://dotbit.me/a/
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProgramId
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
FileId
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LowerCaseLongPath
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LongPathHash
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Name
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
OriginalFileName
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Publisher
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Version
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinFileVersion
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinaryType
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductName
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
ProductVersion
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
LinkDate
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
BinProductVersion
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
AppxPackageFullName
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
AppxPackageRelativeId
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Size
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Language
 malicious
\REGISTRY\A\{2abb717b-a0ed-472e-cfb0-f855b0ecb64b}\Root\InventoryApplicationFile\file.exe|7bc5a156b3ccd649
Usn
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
00180011CAB34AC1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
There are 13 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4CA000
heap
page read and write
9D000
stack
page read and write
711000
unkown
page execute read
72D000
unkown
page write copy
19D000
stack
page read and write
72B000
unkown
page write copy
72B000
unkown
page write copy
710000
unkown
page readonly
400000
heap
page read and write
72E000
unkown
page readonly
711000
unkown
page execute read
4C0000
heap
page read and write
1F0000
heap
page read and write
72E000
unkown
page readonly
4CE000
heap
page read and write
72D000
unkown
page read and write
410000
heap
page read and write
710000
unkown
page readonly
There are 8 hidden memdumps, click here to show them.