Windows Analysis Report
MSI_Driver_Utility_Installer.exe

Overview

General Information

Sample name: MSI_Driver_Utility_Installer.exe
Analysis ID: 1540488
MD5: f9c25c5ee0fca9e2bda9f3100a373769
SHA1: a92be1c66580cfea982cebef9653e841a50577db
SHA256: a769543008ab4605c39dbfa1e137456b0b40847c951d95f9b36e6b8fdf016375
Infos:

Detection

Score: 4
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Creates COM task schedule object (often to register a task for autostart)
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info

Classification

Source: MSI_Driver_Utility_Installer.exe Static PE information: certificate valid
Source: MSI_Driver_Utility_Installer.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: \??\C:\Windows\WindowsBase.pdbX source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\MSI\msiDeviceHelper\MSIDeviceHelperApp\obj\Release\MSI_Driver_Utility_Installer.pdb source: MSI_Driver_Utility_Installer.exe
Source: Binary string: PresentationFramework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp, WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\PresentationFramework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F92000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WindowsBase.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: mscorlib.pdbp source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdbU source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdbL source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\WindowsBase.pdb` source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\WindowsBase.pdbpdbase.pdbn6 source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xml.ni.pdbRSDS# source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Core.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: C:\Windows\PresentationFramework.pdbpdbork.pdbdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\PresentationFramework.pdbJp source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PresentationFramework.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: WindowsBase.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp, WER1901.tmp.dmp.4.dr
Source: Binary string: System.Xaml.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: MSI_Driver_Utility_Installer.pdb@, source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdbT source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: PresentationFramework.Aero2.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: nC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbas source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\WindowsBase.pdbG source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbFF#T source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2175106324.00000000059C8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\MSI_Driver_Utility_Installer.pdbpdbler.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.pdb87 source: WER1901.tmp.dmp.4.dr
Source: Binary string: mscorlib.pdbM source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F92000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WER1901.tmp.dmp.4.dr
Source: Binary string: PresentationCore.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: mscorlib.pdbdbework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Xml.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: WindowsBase.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\symbols\dll\PresentationFramework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: n.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: n0C:\Windows\mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\dll\WindowsBase.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Configuration.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Xml.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: CustomMarshalers.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: MSI_Driver_Utility_Installer.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\PresentationFramework.pdbsnO source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F92000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: %%.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: PresentationCore.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp, MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp, WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xaml.ni.pdbRSDSDg{V source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb:6 source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PresentationFramework.Aero2.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: PresentationCore.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Xaml.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Core.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: symbols\dll\mscorlib.pdbLb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: PresentationFramework.Aero2.pdb?3 source: WER1901.tmp.dmp.4.dr
Source: Binary string: ework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: PresentationFramework.Aero2.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\symbols\dll\WindowsBase.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F92000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\PresentationFramework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PresentationFramework.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Creates COM task schedule object (often to register a task for autostart)
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LocalServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LocalServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LocalServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LocalServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LocalServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\LocalServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs Jump to behavior
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/MainWindow.xaml
Source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/MainWindow.xamld
Source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/MainWindow.xaml
Source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/MainWindow.xamld
Source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/bar/mainwindow.baml
Source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/bar/mainwindow.bamld
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://ocsp.digicert.com0X
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: Amcache.hve.4.dr String found in binary or memory: http://upx.sf.net
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: https://download.)https://download-cn.
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: https://liveupdate.-https://liveupdate-cn.
Source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liveupdate.msi.com/cd/MSI_WU_DRIVER/MB/DQA/
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: https://liveupdate.msi.com/cd/MSI_WU_DRIVER/MB/DQA/Miscellaneous.cfg
Source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liveupdate.msi.com/cd/MSI_WU_DRIVER/MB/Release/
Source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://liveupdate.msi.com/cd/MSI_WU_DRIVER/MB/Release/Miscellaneous.cfg
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: https://liveupdate.msi.com/cd/MSI_WU_DRIVER/MB/Release/Miscellaneous.cfgghttps://liveupdate.msi.com/
Source: MSI_Driver_Utility_Installer.exe String found in binary or memory: https://www.globalsign.com/repository/0
One or more processes crash
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1300
Sample file is different than original file name gathered from version info
Source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs MSI_Driver_Utility_Installer.exe
Source: MSI_Driver_Utility_Installer.exe, App.cs Task registration methods: 'CreateTaskOnLogonAndNetworkConnect', 'CreateTaskAndRun', 'CreateTaskOnLogon'
Source: MSI_Driver_Utility_Installer.exe, ITaskFolder.cs Task registration methods: 'RegisterTaskDefinition'
Source: classification engine Classification label: clean4.winEXE@2/6@0/0
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe File created: C:\Users\user\Desktop\Log Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3064
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Mutant created: \Sessions\1\BaseNamedObjects\MSI Driver Utility Installer
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe File created: C:\Users\user\AppData\Local\Temp\MSI_Driver_Utility_Installer Jump to behavior
Source: MSI_Driver_Utility_Installer.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: MSI_Driver_Utility_Installer.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe File read: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe "C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe"
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1300
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: MSI_Driver_Utility_Installer.exe Static PE information: certificate valid
Source: MSI_Driver_Utility_Installer.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: MSI_Driver_Utility_Installer.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: MSI_Driver_Utility_Installer.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: \??\C:\Windows\WindowsBase.pdbX source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\MSI\msiDeviceHelper\MSIDeviceHelperApp\obj\Release\MSI_Driver_Utility_Installer.pdb source: MSI_Driver_Utility_Installer.exe
Source: Binary string: PresentationFramework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp, WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\PresentationFramework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F92000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: WindowsBase.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: mscorlib.pdbp source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdbU source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbpdblib.pdbL source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\WindowsBase.pdb` source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\WindowsBase.pdbpdbase.pdbn6 source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xml.ni.pdbRSDS# source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Core.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: C:\Windows\PresentationFramework.pdbpdbork.pdbdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\PresentationFramework.pdbJp source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PresentationFramework.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: WindowsBase.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp, WER1901.tmp.dmp.4.dr
Source: Binary string: System.Xaml.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: MSI_Driver_Utility_Installer.pdb@, source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdbT source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: PresentationFramework.Aero2.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: nC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbas source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\WindowsBase.pdbG source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbFF#T source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2175106324.00000000059C8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\MSI_Driver_Utility_Installer.pdbpdbler.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\WindowsBase.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.pdb87 source: WER1901.tmp.dmp.4.dr
Source: Binary string: mscorlib.pdbM source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F92000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WER1901.tmp.dmp.4.dr
Source: Binary string: PresentationCore.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: mscorlib.pdbdbework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Xml.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: WindowsBase.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\symbols\dll\PresentationFramework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000FC2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: n.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: n0C:\Windows\mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\dll\WindowsBase.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Configuration.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Xml.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: CustomMarshalers.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: MSI_Driver_Utility_Installer.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\PresentationFramework.pdbsnO source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F92000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: %%.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: PresentationCore.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2174474839.0000000002B35000.00000004.00000800.00020000.00000000.sdmp, MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp, WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Xaml.ni.pdbRSDSDg{V source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb:6 source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PresentationFramework.Aero2.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: PresentationCore.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Xaml.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Core.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: symbols\dll\mscorlib.pdbLb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: PresentationFramework.Aero2.pdb?3 source: WER1901.tmp.dmp.4.dr
Source: Binary string: ework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173389154.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp
Source: Binary string: PresentationFramework.Aero2.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Source: Binary string: \??\C:\Windows\symbols\dll\WindowsBase.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F92000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\PresentationFramework.pdb source: MSI_Driver_Utility_Installer.exe, 00000000.00000002.2173980447.0000000000F24000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: PresentationFramework.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.ni.pdb source: WER1901.tmp.dmp.4.dr
Source: Binary string: System.Core.ni.pdbRSDS source: WER1901.tmp.dmp.4.dr
Binary contains a suspicious time stamp
Source: MSI_Driver_Utility_Installer.exe Static PE information: 0xF1B9BB18 [Sun Jul 6 10:31:52 2098 UTC]
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Memory allocated: ED0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Memory allocated: 2AC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Memory allocated: 10E0000 memory reserve | memory write watch Jump to behavior
Source: Amcache.hve.4.dr Binary or memory string: VMware
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.4.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Queries volume information: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSI_Driver_Utility_Installer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.4.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: MsMpEng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1540488 Sample: MSI_Driver_Utility_Installer.exe Startdate: 23/10/2024 Architecture: WINDOWS Score: 4 5 MSI_Driver_Utility_Installer.exe 6 2->5         started        process3 7 WerFault.exe 22 16 5->7         started       
⊘No contacted IP infos