c413edbc0a0d610a54a725c6288d57f8f91948cae5ff89b2023a5c5ba3e0bb14

Analysis

max time kernel
147s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 22:04

Target

c413edbc0a0d610a54a725c6288d57f8f91948cae5ff89b2023a5c5ba3e0bb14.exe
Size

87KB
MD5

44eb7e15e8314ed6734fcd0c48539df0
SHA1

9a610d707d4321906fa13cbf938574294ca83565
SHA256

c413edbc0a0d610a54a725c6288d57f8f91948cae5ff89b2023a5c5ba3e0bb14
SHA512

426f038ac4a466cccedc138e99866528371d59366b0ddefbe0cb50e134461f2c95ce010bbce37cdb3c2ea84bc6f37133ee1508b56952aa8542e36787e69e878c
SSDEEP

1536:QVMckVfYYZhkaagpqlm4IzDfy7lwQD0j44oCeWcLQ:+McAfYYcaaggl+DuGQDF3WcM

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1912	c413edbc0a0d610a54a725c6288d57f8f91948cae5ff89b2023a5c5ba3e0bb14.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4848	1912	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\c413edbc0a0d610a54a725c6288d57f8f91948cae5ff89b2023a5c5ba3e0bb14.exe
"C:\Users\Admin\AppData\Local\Temp\c413edbc0a0d610a54a725c6288d57f8f91948cae5ff89b2023a5c5ba3e0bb14.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 260
  2⤵
  - Program crash
  PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1912 -ip 1912
1⤵
PID:528

memory/1912-132-0x0000000000400000-0x0000000001433000-memory.dmp

Filesize
16.2MB

Download
memory/1912-133-0x0000000000400000-0x0000000001433000-memory.dmp

Filesize
16.2MB

Download
memory/1912-134-0x0000000000400000-0x0000000001433000-memory.dmp

Filesize
16.2MB

Download
memory/1912-135-0x0000000000400000-0x0000000001433000-memory.dmp

Filesize
16.2MB

Download