d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263

Analysis

max time kernel
92s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 02:48

Target
d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe
Size 1004KB
Sample240607-dal6mahe77
SHA256 d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263
MD5 946393cad9fa2a0e7a07bfa8e8841aba
SHA1 b6fcad3cbcf8fdef0900221a624687143873cf0a
SHA512 84dab9ebb4133e19b9cb1e0f4068a33bff7a53cabbd48d9cefd3822fb9d16ae5dbce65aeb25153157d73c82c38e7410970265003144ec41c00470b424a81819a
SSDEEP 24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHa0UDL7jIPP5:gh+ZkldoPK8Ya0ajIp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2544	WerFault.exe	80

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2544	d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe
2544	d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2544	d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe
2544	d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 4900	2544	d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe	84
PID 2544 wrote to memory of 4900	2544	d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe	84
PID 2544 wrote to memory of 4900	2544	d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe	84

C:\Users\Admin\AppData\Local\Temp\d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe
"C:\Users\Admin\AppData\Local\Temp\d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\d8ebb9d8af83a1fba0655460e47974e1aa1abb4425d4d784cace3a2db99ec263.exe"
  2⤵
  PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 692
  2⤵
  - Program crash
  PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2544 -ip 2544
1⤵
PID:4484

memory/2544-10-0x0000000003860000-0x0000000003864000-memory.dmp

Download