411de63b612351ac054d0fa225c94d0400f850c75b149beb93d4a8db29192bd0

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 08:00

Target

411de63b612351ac054d0fa225c94d0400f850c75b149beb93d4a8db29192bd0.exe
Size

59KB
MD5

f57b890436bed61e6e8fc5c0dd6f79ad
SHA1

3640d24053c0c06c4a35c9b52f5591ca70aa1dd5
SHA256

411de63b612351ac054d0fa225c94d0400f850c75b149beb93d4a8db29192bd0
SHA512

f7adceefde8bd5951758b1c463a9bb237498c39ff247d390a1a0c910aa09e5aab4a466a1c21065c441a8407d18ae8572273df748f98139c2f92ed4bd9963199b
SSDEEP

1536:RLxLKKyuNSly6g5j5jec/amMmsmhP6Z/gC3ew:RLBKISly6gfImZNhM0

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

411de63b612351ac054d0fa225c94d0400f850c75b149beb93d4a8db29192bd0.exe

pid process

4728 411de63b612351ac054d0fa225c94d0400f850c75b149beb93d4a8db29192bd0.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1324 4728 WerFault.exe 411de63b612351ac054d0fa225c94d0400f850c75b149beb93d4a8db29192bd0.exe

pid	process
4728	411de63b612351ac054d0fa225c94d0400f850c75b149beb93d4a8db29192bd0.exe

pid	pid_target	process	target process
1324	4728	WerFault.exe	411de63b612351ac054d0fa225c94d0400f850c75b149beb93d4a8db29192bd0.exe

C:\Users\Admin\AppData\Local\Temp\411de63b612351ac054d0fa225c94d0400f850c75b149beb93d4a8db29192bd0.exe
"C:\Users\Admin\AppData\Local\Temp\411de63b612351ac054d0fa225c94d0400f850c75b149beb93d4a8db29192bd0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 408
2⤵
- Program crash
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4728 -ip 4728
1⤵
PID:4928

memory/4728-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4728-132-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4728-134-0x00000000005F0000-0x0000000000609000-memory.dmp

Filesize
100KB

Download
memory/4728-135-0x00000000005F0000-0x0000000000609000-memory.dmp

Filesize
100KB

Download