fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26

Analysis

max time kernel
139s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 02:18

Target

fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe
Size

1.1MB
MD5

b0798a179e0016df1424e5d5a2d7be84
SHA1

7d8a56d930852d7395852d9c795921e1502960d4
SHA256

fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26
SHA512

2d7352ccc09709441152cc6ddcdded77fa2de9cc78c31b4d234fc2098fda7c3f00071092eb8f92fd36d877639f747046f64d737d9fb43197438cffdcee29034e
SSDEEP

24576:mAHnh+eWsN3skA4RV1Hom2KXMmHa2etDwS23wAtP15:Bh+ZkldoPK8Ya2etDwr3wAN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	616	WerFault.exe	82

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
616	fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe
616	fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
616	fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe
616	fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
616	fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe
616	fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 4464	616	fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe	86
PID 616 wrote to memory of 4464	616	fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe	86
PID 616 wrote to memory of 4464	616	fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe	86

C:\Users\Admin\AppData\Local\Temp\fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe
"C:\Users\Admin\AppData\Local\Temp\fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\fbe5e73ddb3767513e4edd55c38e2f633a26116912ac8294c956d41853c08f26.exe"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 696
  2⤵
  - Program crash
  PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 616 -ip 616
1⤵
PID:4084

memory/616-10-0x0000000003500000-0x0000000003504000-memory.dmp

Filesize
16KB

Download