747e0a45b7aa42aa1f050832f46a07c9b4be8d8f812e1f5321ebab0c6ed9a932

Analysis

max time kernel
137s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 23:44

Target

747e0a45b7aa42aa1f050832f46a07c9b4be8d8f812e1f5321ebab0c6ed9a932.exe
Size

96KB
MD5

d50ae3b9f4ed137494ad275344c3234e
SHA1

a3715d6c87cbabbbfa441d1c1ba838283d43b284
SHA256

747e0a45b7aa42aa1f050832f46a07c9b4be8d8f812e1f5321ebab0c6ed9a932
SHA512

4a599c00c954abb75b30dc965bac7613889388239efc1d831238eb6e94c148045f0aaba45793e48613b8063ddfd0090033596c7b1e2b1aae7d1dcb144ea63585
SSDEEP

1536:2Y3sO2VIrTgked9k9tVijJ/oFuKLD/M0TYu8E6FB2ujm4G:2jO2/ld2VijJ/orplWcu

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

747e0a45b7aa42aa1f050832f46a07c9b4be8d8f812e1f5321ebab0c6ed9a932.exe

pid process

2984 747e0a45b7aa42aa1f050832f46a07c9b4be8d8f812e1f5321ebab0c6ed9a932.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 2984 WerFault.exe 747e0a45b7aa42aa1f050832f46a07c9b4be8d8f812e1f5321ebab0c6ed9a932.exe

pid	process
2984	747e0a45b7aa42aa1f050832f46a07c9b4be8d8f812e1f5321ebab0c6ed9a932.exe

pid	pid_target	process	target process
2008	2984	WerFault.exe	747e0a45b7aa42aa1f050832f46a07c9b4be8d8f812e1f5321ebab0c6ed9a932.exe

C:\Users\Admin\AppData\Local\Temp\747e0a45b7aa42aa1f050832f46a07c9b4be8d8f812e1f5321ebab0c6ed9a932.exe
"C:\Users\Admin\AppData\Local\Temp\747e0a45b7aa42aa1f050832f46a07c9b4be8d8f812e1f5321ebab0c6ed9a932.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 632
2⤵
- Program crash
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2984 -ip 2984
1⤵
PID:4124

memory/2984-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2984-133-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/2984-134-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download