bd962a88f208fa75b9d362b5788847e7452ab31ccb675d56ad283e9489a78dc9

Analysis

max time kernel
148s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 21:14

Target

bd962a88f208fa75b9d362b5788847e7452ab31ccb675d56ad283e9489a78dc9.exe
Size

83KB
MD5

60da72e66718b04a0d9eca429e54682f
SHA1

1e35ec2e60d40f5928669a4914823171e46d180b
SHA256

bd962a88f208fa75b9d362b5788847e7452ab31ccb675d56ad283e9489a78dc9
SHA512

97934c9f58d98469bf414d45b8ce50f8a2fb37dfd64b00d0ea1882b20cf8df4670d9bfb57895d04b655c057f63a6cfd5baa4e640be9cd87b7fc5caa022556ee6
SSDEEP

1536:QlM+IItfzmbkZwTje9T/wKHVZoRospOiwW/9EvM0Br+BE/1fxHU:GM+7tfKCVweZoRoyOiwW/9EXaBEdJU

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
332	bd962a88f208fa75b9d362b5788847e7452ab31ccb675d56ad283e9489a78dc9.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5028	332	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\bd962a88f208fa75b9d362b5788847e7452ab31ccb675d56ad283e9489a78dc9.exe
"C:\Users\Admin\AppData\Local\Temp\bd962a88f208fa75b9d362b5788847e7452ab31ccb675d56ad283e9489a78dc9.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 588
  2⤵
  - Program crash
  PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 332 -ip 332
1⤵
PID:4344

memory/332-132-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/332-133-0x00000000009F0000-0x0000000000A27000-memory.dmp

Filesize
220KB

Download