7bbe534b2882a03bf5cdc87b8bc4faac0847334db1f87da75e8f4bc056a1c311

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 18:58

Target
RewriterPad.exe
Size 11.2MB
Sample261107-xmp8laev5v
SHA256 7bbe534b2882a03bf5cdc87b8bc4faac0847334db1f87da75e8f4bc056a1c311
MD5 bec26c5c70284e6574bb27b2fb0a29ab
SHA1 00db56952ca74bab1941324f4c1d21501b21d958
SHA512 f8a45912f5944f24285d5d951aec2fee17879a2481cfefcda893fbd3471093f8538e38cf47e554a0aa626e6fcaa5b822a5dda7bd66fdeb50586eeeea6567bd90
SSDEEP 98304:w9gUyYcN0f80WbuapzMedL+K8KSQ/oL09hydmYklqqyFbXqt:jugWxMqqk
TLSH
T1A8C64B12F79795ACC45AC4B083565733AA3174CA0B35BAFF46C492342F79BE06E38B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3400	RewriterPad.exe

C:\Users\Admin\AppData\Local\Temp\RewriterPad.exe
"C:\Users\Admin\AppData\Local\Temp\RewriterPad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:3400