File name:

7B5ACA9103F4B4D640E178FF66BED424.exe

Full analysis: https://app.any.run/tasks/c5922237-3acf-4a20-9ba3-4b1c7385a73b
Verdict: Malicious activity
Analysis date: June 19, 2025, 13:27:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

7B5ACA9103F4B4D640E178FF66BED424

SHA1:

F4E3561DACC83E859D48A098CC29F661272E331B

SHA256:

0705A6E4E8638A8041A0607499A0A58076002464996F65E3EA5DB74F26863DF9

SSDEEP:

768:2Q6ieknk+qUWU4DiJ2ua33zrFxKtlJMcpXrPqz+pXJUJlV:2Q6ieRQ2z38JUJl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • 7B5ACA9103F4B4D640E178FF66BED424.exe (PID: 6188)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 7B5ACA9103F4B4D640E178FF66BED424.exe (PID: 6188)

    • Executes application which crashes

      • 7B5ACA9103F4B4D640E178FF66BED424.exe (PID: 6188)

    • Connects to unusual port

      • 7B5ACA9103F4B4D640E178FF66BED424.exe (PID: 6188)

  • INFO

    • Checks supported languages

      • 7B5ACA9103F4B4D640E178FF66BED424.exe (PID: 6188)

    • Creates files or folders in the user directory

      • 7B5ACA9103F4B4D640E178FF66BED424.exe (PID: 6188)
      • WerFault.exe (PID: 4372)

    • Reads the computer name

      • 7B5ACA9103F4B4D640E178FF66BED424.exe (PID: 6188)

    • Checks proxy server information

      • WerFault.exe (PID: 4372)

    • Reads the software policy settings

      • WerFault.exe (PID: 4372)
      • slui.exe (PID: 5480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:13 18:30:25+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 13312
InitializedDataSize: 287744
UninitializedDataSize: -
EntryPoint: 0x345d
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 7b5aca9103f4b4d640e178ff66bed424.exe werfault.exe slui.exe 7b5aca9103f4b4d640e178ff66bed424.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4372C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6188 -s 812C:\Windows\SysWOW64\WerFault.exe
7B5ACA9103F4B4D640E178FF66BED424.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4676"C:\Users\admin\AppData\Local\Temp\7B5ACA9103F4B4D640E178FF66BED424.exe" C:\Users\admin\AppData\Local\Temp\7B5ACA9103F4B4D640E178FF66BED424.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\7b5aca9103f4b4d640e178ff66bed424.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5480C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6188"C:\Users\admin\AppData\Local\Temp\7B5ACA9103F4B4D640E178FF66BED424.exe" C:\Users\admin\AppData\Local\Temp\7B5ACA9103F4B4D640E178FF66BED424.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\7b5aca9103f4b4d640e178ff66bed424.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
Total events
3 867
Read events
3 859
Write events
5
Delete events
3

Modification events

(PID) Process:(4372) WerFault.exeKey:\REGISTRY\A\{b050d6c4-6503-e51c-f071-bcd1bdcf5cd8}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(4372) WerFault.exeKey:\REGISTRY\A\{b050d6c4-6503-e51c-f071-bcd1bdcf5cd8}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(4372) WerFault.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
4C10546800000000
(PID) Process:(4372) WerFault.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
D76E170000000000
Executable files
1
Suspicious files
2
Text files
2
Unknown types
4

Dropped files

PID
Process
Filename
Type
4372WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_7B5ACA9103F4B4D6_929c39867668363255eaba5ec8299f9ea2482b0_181f3f7e_4f51fef2-c6b5-4720-8772-0d145cebe078\Report.wer —
MD5:—
SHA256:—
4372WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6D02.tmp.dmpdmp
MD5:59C77ECB580EB01392E4428F2136E4B3
SHA256:2E0C53D590820205C7B71D90E49E8FE573F19DABD79FC588B8FE3DF184B8FF43
4372WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\7B5ACA9103F4B4D640E178FF66BED424.exe.6188.dmpdmp
MD5:45E9D28E6FD3EFA7E03189954CA67F26
SHA256:F107F95E8FCC4452499439985AC82802FF4535C8AD0E8C414CF7606C80E81E25
61887B5ACA9103F4B4D640E178FF66BED424.exeC:\Users\admin\AppData\Roaming\winhelp.exeexecutable
MD5:7B5ACA9103F4B4D640E178FF66BED424
SHA256:0705A6E4E8638A8041A0607499A0A58076002464996F65E3EA5DB74F26863DF9
4372WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6DB0.tmp.xmlxml
MD5:F3AD4D385E72868FBC6C675F032F66FB
SHA256:35A4873F93C8C904116280A7794BDA7C2E3C3D66D01D7092FDF6F764F8AEB504
4372WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEder
MD5:0F7B8F6A846AA9CA52FA562DDDCDB5ED
SHA256:AFF90E65A81289B80D1FCC5E71B3D88E5D1AAFE22CE358EB6E28A56D1845263D
4372WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:6EC337AB9C771E1C3057829E33236596
SHA256:6FD1CD84772302941F7F67E3024C712C7A2BE2D37369DB3BEDE3AD28A7E70656
4372WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:5B63C0144C61100C949E65C9B4C7B790
SHA256:51E7A9D4403161514027724D012C19E4717FD92CC87B31049944A37B40228B8E
4372WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:6F7F06599541815147133660DB5E14FF
SHA256:A6D2B0FCB4F37751DB86234039DCA3FBCAA69B2BE8B9FE41D457D0D1288A7432
4372WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6D80.tmp.WERInternalMetadata.xmlxml
MD5:33D4CDE444D1326793CCAA43EB01BFBF
SHA256:898E5227B22475A4F2D5309D67A7F3121F237DD2481AD6BF846CA19A4C2493F0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
14
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4372
WerFault.exe
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4372
WerFault.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
5628
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5628
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.104.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1644
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6188
7B5ACA9103F4B4D640E178FF66BED424.exe
103.42.30.29:8090
—
Wujidun Network Limited
CN
malicious
4
System
192.168.100.255:138
—
—
—
whitelisted
4372
WerFault.exe
20.189.173.20:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4372
WerFault.exe
23.55.104.190:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
4372
WerFault.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
watson.events.data.microsoft.com
  • 20.189.173.20
whitelisted
crl.microsoft.com
  • 23.55.104.190
  • 23.55.104.172
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
x1.c.lencr.org
  • 72.246.169.163
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.64
  • 40.126.32.134
  • 40.126.32.140
  • 40.126.32.136
  • 20.190.160.132
  • 40.126.32.138
  • 20.190.160.3
whitelisted

Threats

PID
Process
Class
Message
6188
7B5ACA9103F4B4D640E178FF66BED424.exe
A Network Trojan was detected
ET MALWARE Win32/ProcessKiller CnC Initialization M1
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7B5ACA9103F4B4D640E178FF66BED424.exe