File name:

dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4

Full analysis: https://app.any.run/tasks/90ee4771-e721-4cbd-bc2b-172dc546ea87
Verdict: Malicious activity
Analysis date: January 10, 2025, 19:26:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

6BA61148828CEAF0251C9676E9D7C5FE

SHA1:

0E917CDEAA0947CEA28D7812B2C8722B23F0DEDC

SHA256:

DD60661E4CBB841DC66168C8D7724C93706A7AFAEFB71FBDBCCBB46D9F4456F4

SSDEEP:

49152:oHlGAXWQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZC:5AGQX21RBt7QjTmcaTH/vU4do9Pcjq1u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executes application which crashes

      • dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe (PID: 1140)
  • INFO

    • Reads mouse settings

      • dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe (PID: 1140)
    • The sample compiled with english language support

      • dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe (PID: 1140)
    • Checks supported languages

      • dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe (PID: 1140)
    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6336)
    • Checks proxy server information

      • WerFault.exe (PID: 6336)
    • The process uses AutoIt

      • dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe (PID: 1140)
    • Reads the software policy settings

      • WerFault.exe (PID: 6336)
    • Create files in a temporary directory

      • dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe (PID: 1140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:05 12:18:43+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 711680
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
1140"C:\Users\admin\AppData\Local\Temp\dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe" C:\Users\admin\AppData\Local\Temp\dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6336C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1140 -s 776C:\Windows\SysWOW64\WerFault.exe
dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windows.security.authentication.onlineid.dll
c:\windows\syswow64\onecoreuapcommonproxystub.dll
c:\windows\syswow64\dpapi.dll
c:\windows\syswow64\twinapi.appcore.dll
c:\windows\syswow64\policymanager.dll
c:\windows\syswow64\winhttp.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\ondemandconnroutehelper.dll
c:\windows\syswow64\mswsock.dll
c:\windows\syswow64\iphlpapi.dll
Total events
706
Read events
706
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6336WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_dd60661e4cbb841d_c6dffb1240868a111914afc065cec3c3158c2d2d_0a506ae3_b837b0fc-3255-4a22-8b35-af4de3202f5a\Report.wer
MD5:
SHA256:
1140dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exeC:\Users\admin\AppData\Local\Temp\nondefinitionbinary
MD5:3AE3D942276CE382E08918E7C0FB13FF
SHA256:6CCFC4E3039818A2A28727514B089255F8E6EB87FEE15528D4DBA7E38D85C206
6336WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
1140dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exeC:\Users\admin\AppData\Local\Temp\aut548C.tmpbinary
MD5:3AE3D942276CE382E08918E7C0FB13FF
SHA256:6CCFC4E3039818A2A28727514B089255F8E6EB87FEE15528D4DBA7E38D85C206
6336WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
6336WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5EDC.tmp.dmpbinary
MD5:6F83236BB74F6311A258C0FBF876FE86
SHA256:1870FC6CD9DAF4B64BCF56D3B868D2F32D88EB280FB7AEFD7E86190E1BDABBB3
6336WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6074.tmp.WERInternalMetadata.xmlxml
MD5:4DFD898268949F4C2B114FD001158B3A
SHA256:12F696F3F67734A1F4A86AE27A6E870E80E8B10F7B6DA2E67A6DA5C8975CB122
6336WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER60B3.tmp.xmlxml
MD5:54634265E33839B02BB4D80CA74487B9
SHA256:270DE7539B96A0FDFAAAF34FEFA8FAB344BC9909C5A92F2C66AFC44CE682B0E5
6336WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:F2AA1F00F2CC6B65ACDB27E7BA53166D
SHA256:7847FE67DB5A0F835E7AAD7C641A11A2095019F9EA0BE0A528DDCCB849CCF692
6336WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\dd60661e4cbb841dc66168c8d7724c93706a7afaefb71fbdbccbb46d9f4456f4.exe.1140.dmpbinary
MD5:AE55BF9691B3682BC7D76644795BC892
SHA256:01F8D1024B40C45EF3CAB1FF6E954CB97FF8C46F50E40F5B93B6D269ED33EBA0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
29
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6336
WerFault.exe
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6968
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6336
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6968
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
104.126.37.185:443
www.bing.com
Akamai International B.V.
DE
whitelisted
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6968
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6968
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
www.bing.com
  • 104.126.37.185
  • 104.126.37.184
  • 104.126.37.123
  • 104.126.37.145
  • 104.126.37.130
  • 104.126.37.128
  • 104.126.37.186
  • 104.126.37.139
  • 104.126.37.179
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.71
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.23
  • 20.190.159.0
  • 40.126.31.71
  • 20.190.159.2
  • 20.190.159.73
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
watson.events.data.microsoft.com
  • 20.42.65.92
whitelisted
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.173
  • 23.48.23.167
  • 23.48.23.145
whitelisted

Threats

No threats detected
No debug info