506b7b737075f3b7e4e413cb60897276a2ad9a2a1e580fe73211a00dfe0af37c

Analysis

max time kernel
204s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 22:06

Target

506b7b737075f3b7e4e413cb60897276a2ad9a2a1e580fe73211a00dfe0af37c.exe
Size

51KB
MD5

c41c8e7401469ee50e1a665f4e1387f1
SHA1

b768aec2d2123fa58134b79ad5137b2b52c9ea60
SHA256

506b7b737075f3b7e4e413cb60897276a2ad9a2a1e580fe73211a00dfe0af37c
SHA512

47a7d1468ae5ccc1f88536e3622e228fbe8574d25067e5fb986aab24296951b6d0a6351c15eab5abdf8fb5555181a56b2561536bd5a5d21b5ba39e6cf6420bf9
SSDEEP

768:3tXNm2sCV6g3jYbiKY7IVqG0L6HpjxE7xhIEAKIkN5GJlZx60:i231TYy7IVWLItiYSX4lP

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3896	506b7b737075f3b7e4e413cb60897276a2ad9a2a1e580fe73211a00dfe0af37c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4040	3896	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\506b7b737075f3b7e4e413cb60897276a2ad9a2a1e580fe73211a00dfe0af37c.exe
"C:\Users\Admin\AppData\Local\Temp\506b7b737075f3b7e4e413cb60897276a2ad9a2a1e580fe73211a00dfe0af37c.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 544
  2⤵
  - Program crash
  PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3896 -ip 3896
1⤵
PID:3276

memory/3896-132-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3896-133-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3896-134-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download