6dbeebffd9de2d1c6c10c7d2bbc221dccf92b8ee4a203f5761d1343e34436a61

Analysis

max time kernel
91s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 09:45

Target

츨11.27ɫ/츨11.27.exe
Size

169KB
MD5

04ab3fe511b4a7465c57fc9e7aedcd3d
SHA1

f678150e525de20a58a2766d52846cc70ffcb622
SHA256

81f15689949e602c3413de07cd00d25baab313dc7a05d5fb05b7de04842a616d
SHA512

e4c5048c1ca4e4a355ff0c85932cb6e67c009f85b79189a0214026521a46744dd592cc3a83246c65a974dce67c570c2288be01150671ebc52ae9584bf10fc393
SSDEEP

3072:uP89l9/zuYu3PvTiqTsKfw6H2vPrzDlNM6FHpU9yP7X4kXq2GzT:cmlzmPvjGHvPn53dBX8p

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

츨11.27.exe

pid process

4008 츨11.27.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2664 4008 WerFault.exe 츨11.27.exe

pid	process
4008	츨11.27.exe

pid	pid_target	process	target process
2664	4008	WerFault.exe	츨11.27.exe

C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.exe
"C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 244
  2⤵
  - Program crash
  PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4008 -ip 4008
1⤵
PID:3188

memory/4008-132-0x00000000003F0000-0x0000000000457000-memory.dmp

Filesize
412KB

Download
memory/4008-133-0x00000000003F0000-0x0000000000457000-memory.dmp

Filesize
412KB

Download
memory/4008-136-0x00000000003F0000-0x0000000000457000-memory.dmp

Filesize
412KB

Download