d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2

Analysis

max time kernel
143s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 01:22

Target

d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe
Size

1007KB
MD5

415f2625a06149e4faa269e6c939ddf4
SHA1

046c676975c09191c4031a876bd5ed506b4cf513
SHA256

d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2
SHA512

75fc0f277ecb2af0f1c5796f6f95e88379538717863716adb11206240461280fad64269334aaf8ac2cf0828394e9f39e4b5d5161ac1995dac7bbcdbf49402179
SSDEEP

24576:JAHnh+eWsN3skA4RV1Hom2KXMmHaAv5PJCfN+b5:Qh+ZkldoPK8YaABsNi

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

8 4560 WerFault.exe d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe

pid	pid_target	process	target process
8	4560	WerFault.exe	d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe

pid	process
4560	d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe
4560	d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe

pid	process
4560	d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe
4560	d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe

description	pid	process	target process
PID 4560 wrote to memory of 2324	4560	d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe	RegSvcs.exe
PID 4560 wrote to memory of 2324	4560	d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe	RegSvcs.exe
PID 4560 wrote to memory of 2324	4560	d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\d27c7cb819083f9737f921ee129a7d3176e6d91f58a1e4e17c5a2c2c8de6a3b2.exe"
2⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 680
2⤵
- Program crash
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4560 -ip 4560
1⤵
PID:1548

memory/4560-10-0x0000000003E80000-0x0000000003E84000-memory.dmp

Filesize
16KB

Download