1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 02:08

Target

1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe
Size

1.2MB
MD5

d9015a5146e13d6d4a23d908e9b863a1
SHA1

cb6436ab865dc1df554063d5fbf3b6ceb8d58712
SHA256

1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480
SHA512

684f19b4ec97fd766054250ab9550e70a3a3bec47d83dfd2e824f4f9034e77c49948b629bae77ba0f454b4ecf904a5d8feedd7904c90292c609856323f4ef39d
SSDEEP

24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8aBJKH6bjq49YWNO:DTvC/MTQYxsWR7aBJKH6bG49YW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1696	2440	WerFault.exe	81

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2440	1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2440	1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe
2440	1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2440	1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe
2440	1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2928	2440	1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe	86
PID 2440 wrote to memory of 2928	2440	1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe	86
PID 2440 wrote to memory of 2928	2440	1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe	86

C:\Users\Admin\AppData\Local\Temp\1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe
"C:\Users\Admin\AppData\Local\Temp\1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\1fc262431bf4d498c60edf371650da94b349addd1cb1ef3d63c3cf6578196480.exe"
  2⤵
  PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 724
  2⤵
  - Program crash
  PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2440 -ip 2440
1⤵
PID:4664

C:\Users\Admin\AppData\Local\Temp\aut376B.tmp

Filesize
264KB

MD5
a24ff6d3d8c1b3f52edc43749a00ccbd

SHA1
f3d1052b26e9253d02369b97bf450eb7caca42e1

SHA256
ec81d87bbf9802c4e89bc07e77173343af903f41100c911571741688c1bfb7a3

SHA512
5b9d3539d70e56616fc9ebb76747a789ef182aea89aff4d9c3a9e6d2bbd708891b68a38c133acb9115054dd1c933965475cba2dd5688cf71bafc5617dde34972

Download Submit
memory/2440-12-0x0000000000ED0000-0x0000000000ED4000-memory.dmp

Filesize
16KB

Download