1e978f9081a38530567bd778d25cebdf6297ce2f8c6d1fed644d75ac102fd567

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:51

Target
Payroll List.exe
Size 1.1MB
Sample240603-lvg2eaae8z
SHA256 1e978f9081a38530567bd778d25cebdf6297ce2f8c6d1fed644d75ac102fd567
MD5 51989583bada20d6d17d602cc0277322
SHA1 653f63e14f59b6049559dc487b9f3210ff2bdaef
SHA512 930e85fbe8d071a701589ef5a16c29653424d4c554eeb363931e050045a9b731803fb4a41d4cb953e48d24c2139f4c9b53dd6a78292cf5d6912ba92fc05661c5
SSDEEP 24576:SAHnh+eWsN3skA4RV1Hom2KXMmHatxnbXzUY9pT0CQT3TF5:Vh+ZkldoPK8YatBbXz99pIlT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
464	2284	WerFault.exe	81

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2284	Payroll List.exe
2284	Payroll List.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2284	Payroll List.exe
2284	Payroll List.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2284	Payroll List.exe
2284	Payroll List.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 3452	2284	Payroll List.exe	85
PID 2284 wrote to memory of 3452	2284	Payroll List.exe	85
PID 2284 wrote to memory of 3452	2284	Payroll List.exe	85

C:\Users\Admin\AppData\Local\Temp\Payroll List.exe
"C:\Users\Admin\AppData\Local\Temp\Payroll List.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Payroll List.exe"
  2⤵
  PID:3452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 728
  2⤵
  - Program crash
  PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2284 -ip 2284
1⤵
PID:548

aut2E44.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut2E44.tmp
Size 265KB
SHA256 76fc9fe1523df4d560892d0c3afa0e4397a6862b1aeb5eb730055030cc40deb3
MD5 a1519b98c3f356bfa38930fbf9dc5269
SHA1 a58cae59c1ee0422118d80fa0c221ad857d5b78d
SHA512 310acba18ed95d11598b126ecd085508c9e2013780470f5977151c7f04ebb6daa3d219fd0698b38672f4f8c524906cb5f9d09b724483125a8513c2a4f671ab87
SSDEEP 6144:8DmhQEg/UDVWkv7SWbymR81NSpSJbzPnozGHAgkn1lbfng7MqVuy:8OQt/UD0kve6ENP9nTbkfs7hVuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2284-12-0x0000000003910000-0x0000000003914000-memory.dmp

Download