16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:49

Target

16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe
Size

115KB
MD5

d14ba65338b03255b0caf3b40b6bd76b
SHA1

16a261aa344eb9a23ce1090cc024f3f769de7c55
SHA256

16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175
SHA512

872882b6905b2c716faf0e34ae6da0425f9a48bc7a899e62bcf4d66930a13103bf77eba951ee8f930946b60868062f121d81f5d5c10aef484b8f80d8a49b2f87
SSDEEP

1536:eAB6uwU1FiJWT3GmA8oidfSz5TVgdjOb2RADCGAi8AijAi:eAQ/UTyGS8oeYvgdjWrlP8PjP

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe

pid process

3372 16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1516 3372 WerFault.exe 16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe

pid	process
3372	16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe

pid	pid_target	process	target process
1516	3372	WerFault.exe	16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe

C:\Users\Admin\AppData\Local\Temp\16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe
"C:\Users\Admin\AppData\Local\Temp\16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 604
2⤵
- Program crash
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3372 -ip 3372
1⤵
PID:3548

memory/3372-132-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3372-133-0x0000000000A20000-0x0000000000A28000-memory.dmp

Filesize
32KB

Download
memory/3372-134-0x0000000000A20000-0x0000000000A28000-memory.dmp

Filesize
32KB

Download