IOC Report
Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe

loading gif

Files

File Path
Type
Category
Malicious
Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Po110-11#U3000Or_74ab44bf1d935e2ca69145489c2f99ce846e82_fcc1023b_eb5b3316-d1e5-429a-abff-e47306e8f50f\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC72A.tmp.dmp
Mini DuMP crash report, 15 streams, Mon Oct 21 05:35:51 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC825.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC855.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe
"C:\Users\user\Desktop\Po110-11#U3000Order_System Electro %100% S51105P-E01 #Uff08#U6700#U65b0#Uff09jpg .exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 780

URLs

Name
IP
Malicious
http://upx.sf.net
unknown

Registry

Path
Value
Malicious
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
ProgramId
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
FileId
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
LowerCaseLongPath
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
LongPathHash
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
Name
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
OriginalFileName
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
Publisher
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
Version
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
BinFileVersion
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
BinaryType
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
ProductName
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
ProductVersion
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
LinkDate
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
BinProductVersion
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
AppxPackageFullName
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
AppxPackageRelativeId
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
Size
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
Language
\REGISTRY\A\{7c4f89fd-a407-6178-2947-7783a4561f79}\Root\InventoryApplicationFile\po110-11#u3000or|349fa20a956d0e82
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1030000
heap
page read and write
2E10000
heap
page read and write
FD0000
trusted library allocation
page read and write
122F000
stack
page read and write
EBE000
stack
page read and write
554E000
stack
page read and write
103E000
heap
page read and write
2D7E000
stack
page read and write
E20000
heap
page read and write
14D0000
heap
page read and write
FE3000
trusted library allocation
page execute and read and write
BCC000
stack
page read and write
550E000
stack
page read and write
2DA0000
heap
page execute and read and write
1066000
heap
page read and write
2DEE000
stack
page read and write
1058000
heap
page read and write
EE0000
heap
page read and write
1017000
trusted library allocation
page execute and read and write
2E21000
trusted library allocation
page read and write
103B000
heap
page read and write
9A2000
unkown
page readonly
ACB000
stack
page read and write
13EE000
stack
page read and write
1230000
trusted library allocation
page read and write
127E000
stack
page read and write
12BD000
stack
page read and write
564E000
stack
page read and write
1490000
trusted library allocation
page execute and read and write
E30000
heap
page read and write
12E0000
heap
page read and write
1074000
heap
page read and write
101B000
trusted library allocation
page execute and read and write
4F1E000
stack
page read and write
E7E000
stack
page read and write
9A0000
unkown
page readonly
FE4000
trusted library allocation
page read and write
A2E000
unkown
page readonly
105D000
heap
page read and write
3E21000
trusted library allocation
page read and write
108F000
heap
page read and write
14B0000
heap
page read and write
12C0000
heap
page read and write
EE6000
heap
page read and write
There are 34 hidden memdumps, click here to show them.