dcf61957f3e1daa4a083aaf48dbea85c825659ceae1477bf6981b39508e5e221

Analysis

max time kernel
152s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 21:31

Target

dcf61957f3e1daa4a083aaf48dbea85c825659ceae1477bf6981b39508e5e221.exe
Size

86KB
MD5

826acd45301c852c1baa18aa61233d26
SHA1

96de1a773f9ff0a611b0c68850f8b17f1c4c89e4
SHA256

dcf61957f3e1daa4a083aaf48dbea85c825659ceae1477bf6981b39508e5e221
SHA512

d272361afd8aa7c5c33a459fcc591bdeae0a505bb700508106abd5db8230c4acf01d7fa7206c73b1925de84409fedff4e62910338ed408e7e1565599142f6d5f
SSDEEP

1536:WW1Gqe+d72sZTxmnPvrmvWtmIbZk9b3iKNA37U9b3iKNA37U9b3iKNA37:WWNdZTx4/t7+3923C3923q3923

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4736	dcf61957f3e1daa4a083aaf48dbea85c825659ceae1477bf6981b39508e5e221.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4904	4736	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\dcf61957f3e1daa4a083aaf48dbea85c825659ceae1477bf6981b39508e5e221.exe
"C:\Users\Admin\AppData\Local\Temp\dcf61957f3e1daa4a083aaf48dbea85c825659ceae1477bf6981b39508e5e221.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 556
  2⤵
  - Program crash
  PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4736 -ip 4736
1⤵
PID:4896

memory/4736-132-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4736-133-0x0000000002180000-0x0000000002199000-memory.dmp

Filesize
100KB

Download
memory/4736-134-0x0000000002180000-0x0000000002199000-memory.dmp

Filesize
100KB

Download