6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:09

Target

6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe
Size

83KB
MD5

cdd36c533459172fc96767321528a0e2
SHA1

dd55e6f267f6589fa0da782f213275158e2c905c
SHA256

6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a
SHA512

446fafa5ca48135ad5e5f9ea9aca28f08739d4e58369cb388caa4a5e769951b747d625096a7328342c90eb75192b3ef223e91f14998cef0b6507f5e7b7e8b218
SSDEEP

1536:HhcwHvWy6ZTy/2JR/HI/yXqUQ688oaVRTWTromVjUafLi6M94:yQWyB2nA/yxQGVRaT0oLi6M94

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe

pid process

3548 6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4976 3548 WerFault.exe 6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe

pid	process
3548	6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe

pid	pid_target	process	target process
4976	3548	WerFault.exe	6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe

C:\Users\Admin\AppData\Local\Temp\6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe
"C:\Users\Admin\AppData\Local\Temp\6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 496
2⤵
- Program crash
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3548 -ip 3548
1⤵
PID:4868

memory/3548-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3548-133-0x0000000002170000-0x0000000002189000-memory.dmp

Filesize
100KB

Download
memory/3548-134-0x0000000002170000-0x0000000002189000-memory.dmp

Filesize
100KB

Download