Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

A Deep Dive into the GetProcessHandleFromHwnd API In my previous blog post I mentioned the GetProcessHandleFromHwnd API. This was an API I didn’t know existed until I found a publicly disclosed UAC bypass using the Quick Assist UI Access application. This API looked interesting so I thought I should take a closer look. I typically start by reading the documentation for an API I don’t know about, assuming it’s documented at all. It can give you an idea of how long the API has…

https://projectzero.google/2026/02/gphfh-deep-dive.html

sha256:37b293fcc2af67b5ef2212f19bd0316bdf45f61656a2f65c4c0944b13944446e

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve1
md50
url0
ipv40
ipv60
sha10
domain7
sha2560
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	oleacc.dll	Open →
domain	oleacchooks.dll	Open →
domain	win32kfull.sys	Open →
domain	vivetool.exe	Open →
domain	werfaultsecure.exe	Open →
domain	wersecurefault.exe	Open →
domain

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports