IOC Report
01_extracted.exe

loading gif

Files

File Path
Type
Category
Malicious
01_extracted.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_01_extracted.exe_82751c43976783803cb27442748f3d308a5a22_13b12cd7_f8022c4e-ad0c-49a2-a959-75bd881bc8f0\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER35AF.tmp.dmp
Mini DuMP crash report, 14 streams, Sun Oct 20 16:17:09 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER36E9.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3709.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\indivisibility
AmigaOS outline font
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\01_extracted.exe
"C:\Users\user\Desktop\01_extracted.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 652

URLs

Name
IP
Malicious
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
ProgramId
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
FileId
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
LowerCaseLongPath
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
LongPathHash
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
Name
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
OriginalFileName
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
Publisher
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
Version
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
BinFileVersion
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
BinaryType
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
ProductName
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
ProductVersion
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
LinkDate
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
BinProductVersion
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
AppxPackageFullName
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
AppxPackageRelativeId
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
Size
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
Language
 malicious
\REGISTRY\A\{491af858-f856-81e2-8820-d828142ed680}\Root\InventoryApplicationFile\01_extracted.exe|71ea31f2cc6497c8
Usn
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
CE7000
unkown
page readonly
1562000
heap
page read and write
4131000
heap
page read and write
1DED000
stack
page read and write
1768000
heap
page read and write
1815000
heap
page read and write
1410000
heap
page read and write
18C9000
heap
page read and write
C20000
unkown
page readonly
26D4000
heap
page read and write
1520000
heap
page read and write
151E000
stack
page read and write
13BF000
stack
page read and write
CD4000
unkown
page readonly
13DB000
stack
page read and write
CAF000
unkown
page readonly
1850000
heap
page read and write
18D5000
heap
page read and write
1460000
heap
page read and write
1528000
heap
page read and write
C20000
unkown
page readonly
45D2000
heap
page read and write
17B3000
heap
page read and write
18F5000
heap
page read and write
CE7000
unkown
page readonly
1836000
heap
page read and write
16F0000
heap
page read and write
13CE000
stack
page read and write
4310000
heap
page read and write
3EE2000
heap
page read and write
18C3000
heap
page read and write
C19000
stack
page read and write
44C8000
heap
page read and write
1756000
heap
page read and write
CE2000
unkown
page write copy
14DE000
stack
page read and write
1543000
heap
page read and write
13FC000
stack
page read and write
2730000
heap
page read and write
26D0000
heap
page read and write
C21000
unkown
page execute read
CAF000
unkown
page readonly
3EED000
heap
page read and write
21EF000
stack
page read and write
18A4000
heap
page read and write
145E000
stack
page read and write
3FA7000
heap
page read and write
17FB000
heap
page read and write
CDE000
unkown
page write copy
C21000
unkown
page execute read
16BA000
heap
page read and write
CD4000
unkown
page readonly
1871000
heap
page read and write
1490000
heap
page read and write
4311000
heap
page read and write
CDE000
unkown
page read and write
26B0000
heap
page read and write
4412000
heap
page read and write
25EE000
stack
page read and write
There are 49 hidden memdumps, click here to show them.