9bc4a06aeca12e27bfe7a059c218d156fb853b8a01227172ec0ed9fcb8100a6b

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 18:58

Target
RewriterPad.exe
Size 11.2MB
Sample261107-xmnd1aev41
SHA256 9bc4a06aeca12e27bfe7a059c218d156fb853b8a01227172ec0ed9fcb8100a6b
MD5 66f6185615bef5a39abed73403d35368
SHA1 8a4296a1abb197801a8ec88c501438d1f1eec7ad
SHA512 d2affd4d88ac199bd7097ef8f4341dc9fade5d7313c62dc0666186e2e09e73ae7fd0597bfe9ffae6e29356b6cf6d42716849001d6d0ec23dacb49a50736cb679
SSDEEP 98304:LcqOw9+3gjXW2mgpNycpB+QEIOye7xukFXxFviRUCJNNbS/ng7:JtocmRNyUI
TLSH
T11BC64A12F79795ACC45AC4B0835657336A3174CE0B35BAFF46C482782F79AE06E38B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5096	RewriterPad.exe

C:\Users\Admin\AppData\Local\Temp\RewriterPad.exe
"C:\Users\Admin\AppData\Local\Temp\RewriterPad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3008