bf251a5a5f8af44135a4d2d6662796f6c4cb53fed7453628113e434f08e9d07a

Analysis

max time kernel
84s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 23:36

Target

bf251a5a5f8af44135a4d2d6662796f6c4cb53fed7453628113e434f08e9d07a.exe
Size

83KB
MD5

4dcae7fc350fa0741400bae824dc0ad6
SHA1

b22a23d80eee8c2fcd2cf6e143159ad0967b3512
SHA256

bf251a5a5f8af44135a4d2d6662796f6c4cb53fed7453628113e434f08e9d07a
SHA512

bfcd21210a26b358c17b59dfac4daf82a33d3e0d0635699569d0efd883a1e60455b8f09135e4f9f73c9f14f5223aca9141f374d5967a14c88a0166f82afa4715
SSDEEP

1536:0FGWJzMPMcbji/SBTjH9fJMHVZoRoIdRKzcEitG8wpEgDbXV4DoPVHP:6GWlgRbjim7QZoRotzcmEBuP

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
844	bf251a5a5f8af44135a4d2d6662796f6c4cb53fed7453628113e434f08e9d07a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	844	WerFault.exe	83

C:\Users\Admin\AppData\Local\Temp\bf251a5a5f8af44135a4d2d6662796f6c4cb53fed7453628113e434f08e9d07a.exe
"C:\Users\Admin\AppData\Local\Temp\bf251a5a5f8af44135a4d2d6662796f6c4cb53fed7453628113e434f08e9d07a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 584
  2⤵
  - Program crash
  PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 844 -ip 844
1⤵
PID:3468

memory/844-132-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/844-133-0x0000000000580000-0x000000000063F000-memory.dmp

Filesize
764KB

Download