2bc78b2cb385b002ee7cf3406e93c7ee336765022f9c3298637dc6496d8fc2fe

Analysis

max time kernel
178s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 19:17

Target

츨12.16ɫ/츨12.16.exe
Size

169KB
MD5

04ab3fe511b4a7465c57fc9e7aedcd3d
SHA1

f678150e525de20a58a2766d52846cc70ffcb622
SHA256

81f15689949e602c3413de07cd00d25baab313dc7a05d5fb05b7de04842a616d
SHA512

e4c5048c1ca4e4a355ff0c85932cb6e67c009f85b79189a0214026521a46744dd592cc3a83246c65a974dce67c570c2288be01150671ebc52ae9584bf10fc393
SSDEEP

3072:uP89l9/zuYu3PvTiqTsKfw6H2vPrzDlNM6FHpU9yP7X4kXq2GzT:cmlzmPvjGHvPn53dBX8p

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

츨12.16.exe

pid process

4868 츨12.16.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4080 4868 WerFault.exe 츨12.16.exe

pid	process
4868	츨12.16.exe

pid	pid_target	process	target process
4080	4868	WerFault.exe	츨12.16.exe

C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.exe
"C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 244
2⤵
- Program crash
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4868 -ip 4868
1⤵
PID:4252

memory/4868-132-0x0000000000E40000-0x0000000000EA7000-memory.dmp

Filesize
412KB

Download
memory/4868-133-0x0000000000E40000-0x0000000000EA7000-memory.dmp

Filesize
412KB

Download
memory/4868-136-0x0000000000E40000-0x0000000000EA7000-memory.dmp

Filesize
412KB

Download