File name:

0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e

Full analysis: https://app.any.run/tasks/cc75e3ab-0079-42dc-bd71-7b323d0c75da
Verdict: Malicious activity
Analysis date: January 10, 2025, 22:00:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

44C88692F3EF514B0669957AF57D8F7D

SHA1:

B7150082DAC8B59B1397AB9888876198B7343C35

SHA256:

0C93729FAD91F61F8BDE7E40D8F3F056FE172E4124638413B5809E53AF991B4E

SSDEEP:

49152:sHlGAXWQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZ8:dAGQX21RBt7QjTmcaTH/vU4do9Pcjq1s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executes application which crashes

      • 0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe (PID: 2956)
  • INFO

    • Reads mouse settings

      • 0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe (PID: 2956)
    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6360)
    • Reads the software policy settings

      • WerFault.exe (PID: 6360)
    • Create files in a temporary directory

      • 0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe (PID: 2956)
    • Checks supported languages

      • 0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe (PID: 2956)
    • The process uses AutoIt

      • 0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe (PID: 2956)
    • Checks proxy server information

      • WerFault.exe (PID: 6360)
    • The sample compiled with english language support

      • 0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe (PID: 2956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

CharacterSet: Unicode
LanguageCode: English (British)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x27dcd
UninitializedDataSize: -
InitializedDataSize: 625664
CodeSize: 581120
LinkerVersion: 12
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2024:12:13 02:06:41+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe svchost.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
2956"C:\Users\admin\AppData\Local\Temp\0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe" C:\Users\admin\AppData\Local\Temp\0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6192"C:\Users\admin\AppData\Local\Temp\0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe" C:\Windows\SysWOW64\svchost.exe0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6360C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2956 -s 796C:\Windows\SysWOW64\WerFault.exe
0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 096
Read events
3 096
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6360WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_0c93729fad91f61f_3a5ac3b56e3c833d8dcd2a1b4a69f4d2716e34f_062ca92b_ff659f40-1b91-49e2-9a5d-3f8919e8beb7\Report.wer
MD5:
SHA256:
6360WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5BCF.tmp.dmpbinary
MD5:C2BDCA2B56AB74DE81749DAE3D8F4BE4
SHA256:B46D5FE73F273525F6DB8A39BE2476C1DB656B35D6328C86758DB4E3681C3112
29560c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exeC:\Users\admin\AppData\Local\Temp\lardsbinary
MD5:712A9F98054ACF86D3591BD79C465A6F
SHA256:CE41715865DE0DE246E3363D28A7BA23A86BBD9CF8423959342FCD6769F0BBA3
6360WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
29560c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exeC:\Users\admin\AppData\Local\Temp\aut5334.tmpbinary
MD5:712A9F98054ACF86D3591BD79C465A6F
SHA256:CE41715865DE0DE246E3363D28A7BA23A86BBD9CF8423959342FCD6769F0BBA3
6360WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5D48.tmp.xmlxml
MD5:E4E655940A063C449FD1C898676DA09E
SHA256:3641FBD5F1343A2DDF79C3A2F324F98D48BCCEE0C80C98DDE564E40057B1FA22
6360WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5D18.tmp.WERInternalMetadata.xmlxml
MD5:FBFAA8D662F2BBBA597E82885858373D
SHA256:67FD5E58EA2B6DB1E9BE427280FD4A3FEE865F291233BEB247A83869BC9B5CB1
6360WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEder
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6360WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\0c93729fad91f61f8bde7e40d8f3f056fe172e4124638413b5809e53af991b4e.exe.2956.dmpbinary
MD5:78C26A0F0C1F12FCD2AAC6942F895526
SHA256:8E5E469AA5A840404E37C6980007BE0818A1F3EC0CA4749C9C278CFED5117641
6360WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:577B59286DA440AAF93872F4D2249BED
SHA256:A5EB68C61350CB11438343F2C82931461B4687C0B9190AF9778A86F7443CE699
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
3040
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
3040
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6360
WerFault.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6360
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
3508
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
6968
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3040
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3040
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
5064
SearchApp.exe
104.126.37.146:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 172.217.16.206
whitelisted
www.bing.com
  • 104.126.37.146
  • 104.126.37.177
  • 104.126.37.123
  • 104.126.37.152
  • 104.126.37.128
  • 104.126.37.171
  • 104.126.37.185
  • 104.126.37.176
  • 104.126.37.129
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.68
  • 20.190.159.71
  • 40.126.31.67
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.4
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
watson.events.data.microsoft.com
  • 20.42.73.29
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info