b97848470a787bba376805af57c9c4c7fcf9b2128d2f4f88566c5fa99ea63863

Analysis

max time kernel
110s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 00:16

Target

P4G Save Tool.exe
Size

1.1MB
MD5

bb6d2b3a5db912cf55ae1e9f47501b82
SHA1

ac0229455a552c63820d6a691cb7e5653f72abf6
SHA256

b97848470a787bba376805af57c9c4c7fcf9b2128d2f4f88566c5fa99ea63863
SHA512

2f807b6ab45160fc3542a6f5b46a4e896c2e5f7e2678d849f4ad9cc210d21829ae7334bd6ac96eb5c3eead630aeb0b1f1fa8020b4b4921ef71563f5dc8c3a8b0
SSDEEP

6144:dYjbtlkkHcEGfEd+nYxCvfCZ5TM4DokrnlxKO7iJ0A46WbE6dB07Ihrwrj1shWRf:dKx8VjCZ5Txl07Z/IER47/I

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
540	P4G Save Tool.exe

C:\Users\Admin\AppData\Local\Temp\P4G Save Tool.exe
"C:\Users\Admin\AppData\Local\Temp\P4G Save Tool.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:540

memory/540-0-0x00007FFE03DA3000-0x00007FFE03DA5000-memory.dmp

Filesize
8KB

Download
memory/540-1-0x0000000000CE0000-0x0000000000DF8000-memory.dmp

Filesize
1.1MB

Download
memory/540-2-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/540-3-0x0000000001620000-0x0000000001628000-memory.dmp

Filesize
32KB

Download
memory/540-4-0x00000000030F0000-0x0000000003128000-memory.dmp

Filesize
224KB

Download
memory/540-5-0x00000000017F0000-0x00000000017FE000-memory.dmp

Filesize
56KB

Download
memory/540-6-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/540-7-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/540-8-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/540-9-0x00007FFE03DA3000-0x00007FFE03DA5000-memory.dmp

Filesize
8KB

Download
memory/540-10-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/540-11-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download
memory/540-12-0x00007FFE03DA0000-0x00007FFE04861000-memory.dmp

Filesize
10.8MB

Download