ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953

Analysis

max time kernel
66s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 01:40

Target

ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe
Size

1.2MB
MD5

7f3495645a47fbe0aed3b69518af96c3
SHA1

91a01966c9007daed292e9a7fcacc29cac90abe9
SHA256

ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953
SHA512

78ba7f692c8d207a8e9685c83d06fd25fd3e6297ed757ffa15e4ee68fa852bdb802fdf1a680b58512c32755356a3ef961c5e8bcec986a8099df8f172b96e240b
SSDEEP

24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8aOuLpHmBzFFM1ONQ9:LTvC/MTQYxsWR7aOuezPXy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2080 4748 WerFault.exe ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe

pid	pid_target	process	target process
2080	4748	WerFault.exe	ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe

pid	process
4748	ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe
4748	ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe

pid	process
4748	ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe
4748	ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe

description	pid	process	target process
PID 4748 wrote to memory of 3500	4748	ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe	RegSvcs.exe
PID 4748 wrote to memory of 3500	4748	ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe	RegSvcs.exe
PID 4748 wrote to memory of 3500	4748	ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\ebf3c83dc7467d503cf0ad20f47b4042dbefb543eae593e605a17cec9e8f3953.exe"
2⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 720
2⤵
- Program crash
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4748 -ip 4748
1⤵
PID:2168

memory/4748-10-0x00000000018D0000-0x00000000018D4000-memory.dmp

Filesize
16KB

Download