8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52

Analysis

max time kernel
144s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2022 13:30

Target

8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe
Size

775KB
MD5

90f90365f007e71989c80cae676359e0
SHA1

e729a8ef0b7100b6cf9b397610c3dfd2dccb1d27
SHA256

8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52
SHA512

32d842c0be32fcce3c003845537f3c0084908eac82b6c7c1211f927f5ac48a12d981e2290d9287e2eb2b0b79891d6f0c3e14131078fbf09cddf0a3fefa9b4616
SSDEEP

24576:4wOlmWzfsw7wFFz0w8gEFGnaNM1JvZEx:0sPL0w8gEdNsvZEx

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4984	8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4276	4984	WerFault.exe	80

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4984	8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe

C:\Users\Admin\AppData\Local\Temp\8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe
"C:\Users\Admin\AppData\Local\Temp\8a9a6796829fe69598bd4a801196880768b0973628033b0a2c4b6c5d76dc3c52.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 692
  2⤵
  - Program crash
  PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4984 -ip 4984
1⤵
PID:4120

memory/4984-132-0x0000000000400000-0x0000000000838000-memory.dmp

Filesize
4.2MB

Download
memory/4984-133-0x0000000000400000-0x0000000000838000-memory.dmp

Filesize
4.2MB

Download
memory/4984-134-0x0000000000400000-0x0000000000838000-memory.dmp

Filesize
4.2MB

Download