ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 03:39

Target

ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe
Size

1.0MB
MD5

bf27a932d79bf41c51666a2c180d57a8
SHA1

d5759f16337b0ca14649352bdffe7b6ad9c1b65c
SHA256

ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe
SHA512

67c2529a93122be401d9cd4a9e2f8fffbb21d723c401f48eb4419d3ab54cd69d70f58f74c6db4622bcd9a46c2ff78acd711373b29f900bb4706a06657ac86301
SSDEEP

24576:zAHnh+eWsN3skA4RV1Hom2KXMmHavsdvB1K2lADL5:+h+ZkldoPK8YavOvvU

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4828 400 WerFault.exe ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe

pid	pid_target	process	target process
4828	400	WerFault.exe	ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe

pid	process
400	ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe
400	ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe

pid	process
400	ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe
400	ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe

description	pid	process	target process
PID 400 wrote to memory of 3244	400	ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe	RegSvcs.exe
PID 400 wrote to memory of 3244	400	ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe	RegSvcs.exe
PID 400 wrote to memory of 3244	400	ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\ecc97660fb9044336595d440673cbabc46dd594b2fa37f57077631e6cb3f8afe.exe"
2⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 700
2⤵
- Program crash
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 400 -ip 400
1⤵
PID:2676

memory/400-10-0x00000000040A0000-0x00000000040A4000-memory.dmp

Filesize
16KB

Download