6ed4184f56615f370a5225505c921ac655e456ed9e84622f192ae938bec243ea

Analysis

max time kernel
131s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 08:23

Target
59e159de76882a4ddf8923bed338a85d.exe
Size 1.0MB
Sample240610-j968qsfa79
SHA256 6ed4184f56615f370a5225505c921ac655e456ed9e84622f192ae938bec243ea
MD5 59e159de76882a4ddf8923bed338a85d
SHA1 a25440020e850cb97fc99c1c56a4be99730b4981
SHA512 0bc42df72fc041047bcdf109f6581abfcbe630550e8ed8bce25fddb3a4d4cf307b7446bee7cecb3973b16073f9fcca1230732944bef8c3915e06815a61f8551b
SSDEEP 24576:HAHnh+eWsN3skA4RV1Hom2KXMmHaHZiC6IrS9gmHT2fS3pf5:6h+ZkldoPK8YaHHRWqe0SH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4156	2552	WerFault.exe	89

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2552	59e159de76882a4ddf8923bed338a85d.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2552	59e159de76882a4ddf8923bed338a85d.exe
2552	59e159de76882a4ddf8923bed338a85d.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2552	59e159de76882a4ddf8923bed338a85d.exe
2552	59e159de76882a4ddf8923bed338a85d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4588	2552	59e159de76882a4ddf8923bed338a85d.exe	93
PID 2552 wrote to memory of 4588	2552	59e159de76882a4ddf8923bed338a85d.exe	93
PID 2552 wrote to memory of 4588	2552	59e159de76882a4ddf8923bed338a85d.exe	93

C:\Users\Admin\AppData\Local\Temp\59e159de76882a4ddf8923bed338a85d.exe
"C:\Users\Admin\AppData\Local\Temp\59e159de76882a4ddf8923bed338a85d.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\59e159de76882a4ddf8923bed338a85d.exe"
  2⤵
  PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 696
  2⤵
  - Program crash
  PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2552 -ip 2552
1⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
1⤵
PID:1776

memory/2552-10-0x0000000001280000-0x0000000001284000-memory.dmp

Download