49902918015bd525f8bf60c7683a85675bfed881d13f270ce3dfb85e6f1fa502

Analysis

max time kernel
143s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:49

Target

49902918015bd525f8bf60c7683a85675bfed881d13f270ce3dfb85e6f1fa502.exe
Size

115KB
MD5

c392f9fdb14d2efe5a3b2d3f3bd6c4c9
SHA1

c96082db67b5d46ea3b0908ba24b3a5e8eeef019
SHA256

49902918015bd525f8bf60c7683a85675bfed881d13f270ce3dfb85e6f1fa502
SHA512

eda2f88a7a53dd877a342898b4638b578a8b014210a88c7fc91e3fd0525ce2aa0d2485e5f7a33191d3fde63c164dc2ed089a8c4c590d5f4f375d17d4e46ba1dc
SSDEEP

1536:iAB6uwU1FiJWT3GmF8oiEvyWQzUF+jhTr8cK1X9atHRGhYh/h:iAQ/UTyGX8oZM8+jhTr8BX2RG2h

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

49902918015bd525f8bf60c7683a85675bfed881d13f270ce3dfb85e6f1fa502.exe

pid process

4752 49902918015bd525f8bf60c7683a85675bfed881d13f270ce3dfb85e6f1fa502.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

208 4752 WerFault.exe 49902918015bd525f8bf60c7683a85675bfed881d13f270ce3dfb85e6f1fa502.exe

pid	process
4752	49902918015bd525f8bf60c7683a85675bfed881d13f270ce3dfb85e6f1fa502.exe

pid	pid_target	process	target process
208	4752	WerFault.exe	49902918015bd525f8bf60c7683a85675bfed881d13f270ce3dfb85e6f1fa502.exe

C:\Users\Admin\AppData\Local\Temp\49902918015bd525f8bf60c7683a85675bfed881d13f270ce3dfb85e6f1fa502.exe
"C:\Users\Admin\AppData\Local\Temp\49902918015bd525f8bf60c7683a85675bfed881d13f270ce3dfb85e6f1fa502.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 604
2⤵
- Program crash
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4752 -ip 4752
1⤵
PID:4488

memory/4752-132-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4752-133-0x0000000000A10000-0x0000000000A18000-memory.dmp

Filesize
32KB

Download
memory/4752-134-0x0000000000A10000-0x0000000000A18000-memory.dmp

Filesize
32KB

Download