5c3852fbab3863719c382c3e764b882f31af61d2f48392528c1cb9880717a069

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 18:58

Target
RewriterPad.exe
Size 11.1MB
Sample261107-xmlv6sev4z
SHA256 5c3852fbab3863719c382c3e764b882f31af61d2f48392528c1cb9880717a069
MD5 bad1b989ef816308a40c7db44777c259
SHA1 0aa4d643aa8995d578d1309ad3ff7bbcbfbdebe5
SHA512 200026cc8e74ba199d8a2c1cd1d95a8219c574b43aac8c6848194c28817bf6f15b80613a5d4fff0575e5673eda27200a10c31498466313a6009a9402338a194f
SSDEEP 98304:4sTQbf1I5TjRm7w5xt4KxxX860S2Uc8t2FJNJLFPjL14bqqoYk:kOmwtjhaN
TLSH
T10BC65A02F79699ACC45AC4B0935697336A3174CE0B35B9FF46C492342F79BE06E38B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3536	RewriterPad.exe

C:\Users\Admin\AppData\Local\Temp\RewriterPad.exe
"C:\Users\Admin\AppData\Local\Temp\RewriterPad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:3536