IOC Report
55876.exe

loading gif

Files

File Path
Type
Category
Malicious
55876.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_55876.exe_1d28606ee4dd33d687b1238c2fc915949b77486c_431570d7_0b3287b9-b17d-494b-8f9c-1ac368821c63\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_55876.exe_458c60b62e70e9612b38d86cdbe9bf45285e9550_431570d7_9297d733-114a-47e8-9564-bea5205a9a9d\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1049.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1069.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCFC.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Nov 25 08:00:14 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD8.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERE17.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFDB.tmp.dmp
Mini DuMP crash report, 14 streams, Mon Nov 25 08:00:15 2024, 0x1205a4 type
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\55876.exe
"C:\Users\user\Desktop\55876.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 776
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 780

URLs

Name
IP
Malicious
http://upx.sf.net
unknown

Domains

Name
IP
Malicious
www.shduih.com
18.167.130.152

IPs

IP
Domain
Country
Malicious
18.167.130.152
www.shduih.com
United States

Registry

Path
Value
Malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
ProgramId
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
FileId
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
LowerCaseLongPath
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
LongPathHash
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
Name
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
OriginalFileName
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
Publisher
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
Version
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
BinFileVersion
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
BinaryType
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
ProductName
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
ProductVersion
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
LinkDate
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
BinProductVersion
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
AppxPackageFullName
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
AppxPackageRelativeId
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
Size
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
Language
 malicious
\REGISTRY\A\{c4042608-7ad1-c1ce-7474-ac3846d9648c}\Root\InventoryApplicationFile\55876.exe|f37542312ee3f60d
Usn
 malicious
There are 9 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
BE0000
heap
page read and write
2A6E000
stack
page read and write
1D0000
heap
page read and write
19D000
stack
page read and write
5AE000
heap
page read and write
400000
unkown
page readonly
273E000
stack
page read and write
590000
heap
page read and write
529000
unkown
page readonly
283F000
stack
page read and write
1D5000
heap
page read and write
8AE000
stack
page read and write
292D000
stack
page read and write
403000
unkown
page readonly
580000
heap
page read and write
9C000
stack
page read and write
5BC000
heap
page read and write
401000
unkown
page execute read
406000
unkown
page read and write
5A0000
heap
page read and write
BB0000
heap
page read and write
407000
unkown
page readonly
2B6F000
stack
page read and write
400000
unkown
page readonly
405000
unkown
page write copy
2A2E000
stack
page read and write
8EE000
stack
page read and write
7AE000
stack
page read and write
401000
unkown
page execute read
403000
unkown
page readonly
5AA000
heap
page read and write
405000
unkown
page write copy
407000
unkown
page readonly
9EF000
stack
page read and write
529000
unkown
page readonly
There are 25 hidden memdumps, click here to show them.