File name:

b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268

Full analysis: https://app.any.run/tasks/271b920c-4183-40ab-a74b-7e15587d593e
Verdict: Malicious activity
Analysis date: January 10, 2025, 19:57:23
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

D8BA09DB25AFABBA3143CB47DD6B8F37

SHA1:

5E19B80E13C51AC6F3E1D196E5C3B73ECEFD5E98

SHA256:

B7B7EFD934672F580AC36002B4F9524DECC68C309052DBDF16F26C48C6D1D268

SSDEEP:

24576:l5pnu0Uy4V+tr0LTmR+Z8hsPxbkFPEA5TH1HUk53ZnKWSQM/Cw:l5pnu0Uy4V+d0LTmR+Z8hsPxbAPr5THm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe (PID: 4428)
      • b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe (PID: 712)

  • SUSPICIOUS

    • Application launched itself

      • b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe (PID: 712)

    • Executes application which crashes

      • b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe (PID: 4428)

  • INFO

    • Reads the machine GUID from the registry

      • b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe (PID: 712)

    • Reads the computer name

      • b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe (PID: 712)

    • Checks supported languages

      • b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe (PID: 712)

    • Reads the software policy settings

      • WerFault.exe (PID: 5540)

    • Checks proxy server information

      • WerFault.exe (PID: 5540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

AssemblyVersion: 11.11.11.11
ProductVersion: 13.13.13.13
ProductName: uiyutt
OriginalFileName: OGGCS.exe
LegalTrademarks: oiyu5767878
LegalCopyright: tytytty
InternalName: OGGCS.exe
FileVersion: 13.13.13.13
FileDescription: 778yugh
CompanyName: 767556767
Comments: jhgffsd
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 13.13.13.13
FileVersionNumber: 13.13.13.13
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0xedeba
UninitializedDataSize: -
InitializedDataSize: 2048
CodeSize: 966656
LinkerVersion: 48
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2082:07:22 15:56:37+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe no specs b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
712"C:\Users\admin\AppData\Local\Temp\b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe" C:\Users\admin\AppData\Local\Temp\b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe—explorer.exe
User:
admin
Company:
767556767
Integrity Level:
MEDIUM
Description:
778yugh
Exit code:
0
Version:
13.13.13.13
Modules
Images
c:\users\admin\appdata\local\temp\b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4428"C:\Users\admin\AppData\Local\Temp\b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe"C:\Users\admin\AppData\Local\Temp\b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe
b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe
User:
admin
Company:
767556767
Integrity Level:
MEDIUM
Description:
778yugh
Exit code:
3221225477
Version:
13.13.13.13
Modules
Images
c:\users\admin\appdata\local\temp\b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5540C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4428 -s 232C:\Windows\SysWOW64\WerFault.exe
b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 177
Read events
3 177
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
5540WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_b7b7efd934672f58_a412a705870824043a962712d19cbfcea9e_86a10de6_639565d0-e2a3-465f-af55-8360ced24134\Report.wer —
MD5:—
SHA256:—
5540WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD892.tmp.WERInternalMetadata.xmlxml
MD5:1C49D62A327512305448F3B883CA550F
SHA256:E667CB9DF54C0E50F884BDB45B9961BE178853F917DE112C4EDA33B977098088
5540WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
5540WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:4FCE4ED86CDD2970DA1B3A3BC1A29685
SHA256:BE8183DA0F681BFB67939CF44FC7CDB1DA1979D1F2DCB732253C12AADB0BF7C9
5540WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
5540WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD8C1.tmp.xmlxml
MD5:F9B5E01E166A252F11BB2F48B9BDE76D
SHA256:E5FFE9A2F71A93954D6C80AAC5BB1D6534F94C71E275D534F1CA82CA505FC296
5540WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD852.tmp.dmpbinary
MD5:1D0C862F9ED67E5A14241FDEDB563C70
SHA256:C3F18EB78DE358B4BAB72D77256D8B7E08C6557A5FF16269011906A140E50D5E
5540WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:63872E94A54DBE90E31F3AD757AF4C2C
SHA256:4CF6C4206553A093A3535189F2F2F16B96F47E587AD31435073F58DE8E6AF08E
5540WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268.exe.4428.dmpbinary
MD5:5B70202144B0CA99F931A53E784E188A
SHA256:B255FF004AC53D71133E917DFEAF2E453538305E65E9B8CB76507F68DC1B7235
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
35
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5780
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5780
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5540
WerFault.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5540
WerFault.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4624
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4536
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4536
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
1176
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.142
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.164
  • 23.48.23.180
  • 23.48.23.158
  • 23.48.23.159
  • 23.48.23.173
  • 23.48.23.177
  • 23.48.23.169
  • 23.48.23.190
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.134
  • 40.126.32.140
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.76
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
b7b7efd934672f580ac36002b4f9524decc68c309052dbdf16f26c48c6d1d268