798d72b65c53e0321bcb992ca1f2b8a75f8fb7d9305aa1d7d0daa487afaf28fd

Analysis

max time kernel
104s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 01:17

Target

798d72b65c53e0321bcb992ca1f2b8a75f8fb7d9305aa1d7d0daa487afaf28fd.exe
Size

1.1MB
MD5

099af7890c41187686be398fe0fb6798
SHA1

33fe044f72474daea6a8838c17fcf3bdf5b069b9
SHA256

798d72b65c53e0321bcb992ca1f2b8a75f8fb7d9305aa1d7d0daa487afaf28fd
SHA512

fe22212177b874ff09d1e2a53cac3ddf17927ae8acfab8d25ac045e4ca562112a614a3d21596c41d2d50913fa55600a82c1690bae1df895173083adcfa7dc9af
SSDEEP

24576:ark8EiW2vqy+XBbIRKlCx+JF42Ejs4vE5N4KNFwkj:ark8EiW2yylKlDujs4vWJNFwkj

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2340	798d72b65c53e0321bcb992ca1f2b8a75f8fb7d9305aa1d7d0daa487afaf28fd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
804	2340	WerFault.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2340	798d72b65c53e0321bcb992ca1f2b8a75f8fb7d9305aa1d7d0daa487afaf28fd.exe

C:\Users\Admin\AppData\Local\Temp\798d72b65c53e0321bcb992ca1f2b8a75f8fb7d9305aa1d7d0daa487afaf28fd.exe
"C:\Users\Admin\AppData\Local\Temp\798d72b65c53e0321bcb992ca1f2b8a75f8fb7d9305aa1d7d0daa487afaf28fd.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 708
  2⤵
  - Program crash
  PID:804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2340 -ip 2340
1⤵
PID:1400

memory/2340-132-0x0000000000400000-0x000000000082F000-memory.dmp

Filesize
4.2MB

Download
memory/2340-133-0x0000000002AB0000-0x0000000002B22000-memory.dmp

Filesize
456KB

Download
memory/2340-134-0x0000000000400000-0x000000000082F000-memory.dmp

Filesize
4.2MB

Download