e94f82b6750e6a61ebe5ddd3aef42014a69f2af85c7975f6ac334c918c272500

Analysis

max time kernel
100s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 13:13

Target

e94f82b6750e6a61ebe5ddd3aef42014a69f2af85c7975f6ac334c918c272500.exe
Size

102KB
MD5

69ed76fb952f96619cf1ab5aaffeb6f0
SHA1

5d5dfdc61ed372d86a2aff127a5030219c7e64e1
SHA256

e94f82b6750e6a61ebe5ddd3aef42014a69f2af85c7975f6ac334c918c272500
SHA512

90cacd9242c7c5b0b94983a47894266f9efb8f8fa0d2822a70f963f16d34e59a4452821a2f2bbfc10321bcbbe39abcf2ba2ae575f03a833b61590caf848ef71d
SSDEEP

1536:ClKdTiucKXYS58kT/kboONR4s8/+r9mtu/O8n1VjADcC7ti:wunH8kT/kboOvk/+Riu/O+PADXti

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4432	e94f82b6750e6a61ebe5ddd3aef42014a69f2af85c7975f6ac334c918c272500.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3736	4432	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\e94f82b6750e6a61ebe5ddd3aef42014a69f2af85c7975f6ac334c918c272500.exe
"C:\Users\Admin\AppData\Local\Temp\e94f82b6750e6a61ebe5ddd3aef42014a69f2af85c7975f6ac334c918c272500.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 632
  2⤵
  - Program crash
  PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4432 -ip 4432
1⤵
PID:4956

memory/4432-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4432-133-0x00000000009F0000-0x0000000000C71000-memory.dmp

Filesize
2.5MB

Download
memory/4432-134-0x00000000009F0000-0x0000000000C71000-memory.dmp

Filesize
2.5MB

Download