File name:

escsvc64.exe

Full analysis: https://app.any.run/tasks/2761b194-5b45-47fa-88f8-c83176d98625
Verdict: Malicious activity
Analysis date: January 14, 2025, 12:49:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

525EA9523A2AFE76D2EAEBC4A6B923EB

SHA1:

E0E30F49E82505CAF9E7852A1071BBCE81D8FCDC

SHA256:

53C772CA6258EE6A1D53BE5E66554D0793F92C631760F1E3ED31366EF4FCCBA7

SSDEEP:

3072:iqEJ+SOloUeUmsZ7WidD0A05eVeAveAK1sfSgh:iqEJbsoUexsZ7WidD0yVe2eP103

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • escsvc64.exe (PID: 6152)
      • escsvc64.exe (PID: 6332)

  • SUSPICIOUS

    • Executes application which crashes

      • escsvc64.exe (PID: 6332)

  • INFO

    • Checks supported languages

      • escsvc64.exe (PID: 6332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2012:05:17 11:12:20+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: 8
CodeSize: 58368
InitializedDataSize: 77824
UninitializedDataSize: -
EntryPoint: 0x3580
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 1.1.0.1
ProductVersionNumber: 1.1.0.1
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Seiko Epson Corporation
FileDescription: Epson Scanner Service (64bit)
FileVersion: 1.1.0.1
LegalCopyright: Copyright (C) Seiko Epson Corporation 2010
OriginalFileName: EscSvc64.exe
ProductName: EPSON Scanner Driver
ProductVersion: 1.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
3
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start escsvc64.exe werfault.exe escsvc64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6152"C:\Users\admin\AppData\Local\Temp\escsvc64.exe" C:\Users\admin\AppData\Local\Temp\escsvc64.exe—explorer.exe
User:
admin
Company:
Seiko Epson Corporation
Integrity Level:
MEDIUM
Description:
Epson Scanner Service (64bit)
Exit code:
3221226540
Version:
1.1.0.1
Modules
Images
c:\users\admin\appdata\local\temp\escsvc64.exe
c:\windows\system32\ntdll.dll
6332"C:\Users\admin\AppData\Local\Temp\escsvc64.exe" C:\Users\admin\AppData\Local\Temp\escsvc64.exe
explorer.exe
User:
admin
Company:
Seiko Epson Corporation
Integrity Level:
HIGH
Description:
Epson Scanner Service (64bit)
Exit code:
3221225501
Version:
1.1.0.1
Modules
Images
c:\users\admin\appdata\local\temp\escsvc64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6504C:\WINDOWS\system32\WerFault.exe -u -p 6332 -s 460C:\Windows\System32\WerFault.exe
escsvc64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
Total events
3 622
Read events
3 616
Write events
3
Delete events
3

Modification events

(PID) Process:(6504) WerFault.exeKey:\REGISTRY\A\{02714fce-d898-f3c8-f687-68a1385d6901}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(6504) WerFault.exeKey:\REGISTRY\A\{02714fce-d898-f3c8-f687-68a1385d6901}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
Executable files
0
Suspicious files
2
Text files
2
Unknown types
5

Dropped files

PID
Process
Filename
Type
6504WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_escsvc64.exe_53d1627f168be861b92b51d2acfa94936fb4840_2aa0144e_f86ac2c3-f97b-4700-ab4f-d53756c543d5\Report.wer —
MD5:—
SHA256:—
6504WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvehiv
MD5:58E479D26CA6CE213F92FC897046B607
SHA256:5F1EA06C698E7A0D52996EAFC5BDE91C6CF5A57D3C1882CC3928C93B218CEEEB
6504WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEder
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6504WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7D90.tmp.dmpdmp
MD5:9BD36F5C9C4244F26CBAF1EFF91655D8
SHA256:28A683FC9AB2E94683E7B43DEF5069D3DCD751278CB5D8C0DA8D83380609DFE4
6504WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER84E4.tmp.WERInternalMetadata.xmlxml
MD5:37B09DDB6C4E19AEB22C9A1BDFFF59DC
SHA256:261F24672327383E99D1E8BBE7BCAFC58290F2F598534ED524609987AE53B30A
6504WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER8571.tmp.xmlxml
MD5:2E9FF9D41C93F410E8D552D74515A6D3
SHA256:FE9F9D88BC5E250F4EEACA8DF48EDF01F3370F65016BB94C2B87995ACEF49507
6504WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:EF97BD3447AE94DBF5C0BAAF8DFB0125
SHA256:6D47CAAFCC3053E624FE397A20C0A9C1399D710101C247348C0911554123E30A
6504WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:93D6ECCF64ACDED2A58F13E526FBBB78
SHA256:8414719EDA248F0B68E6843B24DBE2F5404558791C106D80FA361A2A090C2B3B
6504WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
6504WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\escsvc64.exe.6332.dmpdmp
MD5:5C27A0708AD8B9F2D808EE72FA907BE5
SHA256:5B054AB5F08CE347B5961DA2B6FF12EEB5CBE387D4282D124B73C105E0869DB7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
35
DNS requests
23
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6432
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6432
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6652
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6504
WerFault.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6504
WerFault.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
2.23.227.205:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6332
escsvc64.exe
169.150.247.37:443
www.dssdhome.xyz
—
GB
unknown
6504
WerFault.exe
13.89.179.12:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6504
WerFault.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
6504
WerFault.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.49
  • 2.16.164.51
  • 2.16.164.72
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
www.bing.com
  • 2.23.227.205
  • 2.23.227.208
  • 2.23.227.202
  • 2.23.227.215
  • 2.23.227.221
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
www.dssdhome.xyz
  • 169.150.247.37
unknown
watson.events.data.microsoft.com
  • 13.89.179.12
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.22
  • 20.190.160.14
  • 40.126.32.138
  • 20.190.160.17
  • 40.126.32.140
  • 40.126.32.68
  • 40.126.32.136
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
6332
escsvc64.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
escsvc64.exe