1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 01:14

Target
1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe
Size 1.2MB
Sample240607-blw4vsgb28
SHA256 1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063
MD5 a2466d5fd5103ccaf1dd4a1f84245e09
SHA1 e84c989037250e778fc016064d4c2e8b1cdbacdf
SHA512 86a4ac5d4e3f2ee4f6f056ba8f382b723b9b90b8cc812830fad438d3764bf13a3dc89b86313ac3104f4903b6d6c563fb21b2ecddcd5fe7ede91b73debbcff9a9
SSDEEP 24576:7AHnh+eWsN3skA4RV1Hom2KXMmHaCP9w9f1tXdk9Yb5:Wh+ZkldoPK8YaCPG9PF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	4260	WerFault.exe	82

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4260	1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4260	1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe
4260	1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4260	1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe
4260	1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4868	4260	1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe	85
PID 4260 wrote to memory of 4868	4260	1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe	85
PID 4260 wrote to memory of 4868	4260	1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe	85

C:\Users\Admin\AppData\Local\Temp\1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe
"C:\Users\Admin\AppData\Local\Temp\1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\1e47e611408d9e8afc422dfc44dfad469bf2216a3b168e7e440e4b75aac51063.exe"
  2⤵
  PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 736
  2⤵
  - Program crash
  PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4260 -ip 4260
1⤵
PID:4524

aut3D67.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut3D67.tmp
Size 265KB
SHA256 8702131b5b470052af9dfb10f9ab4c38f09848af0a352acee9af47b9d21e3fe6
MD5 89e1ddf01e45e96c5d08487c1d817f9d
SHA1 b5c3d7db7cf03a30ec535b2d0f87160c57e4cd23
SHA512 3b6b7010dae52d4836e45ef95385af38f76a08b8fc7c1fa95b2cb73a8ffcce8402aae3e74612ed67aa87436d61da379ee4bbca20c04327b565f06ea889e070ef
SSDEEP 6144:3nGWjdD+0jzIMKVxt08lIInVZIiSkAo64aFWQJE+faD:3nGeHIn7RZNwfbJE+CD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4260-12-0x0000000000B80000-0x0000000000B84000-memory.dmp

Download