1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87

Analysis

max time kernel
92s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 16:37

Target

1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87.exe
Size

327KB
MD5

787d26ae83f0a6599e96dc1eafe0cea4
SHA1

392a898abeb50fcd98e4f72671eb9f8c67f564df
SHA256

1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87
SHA512

3858fddbfe55793daf1330a0f06e0db92666ae69bbdb28019afd293d2f3d5e71e1d3d81da59edf49376a008a5a3591a37d5647b67f8aa0c6fc1f634d78faefd5
SSDEEP

6144:MHfQZl8Q3GjMMMMMMoAVbpGoBtC0Ae+F294oLNHkiBOb8j:4fQZl8+YMMMMMM51GoBtCvF2946aiBOs

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87.exe

pid process

1268 1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87.exe

pid	process
1268	1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87.exe

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4952	1268	WerFault.exe	1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87.exe
1280	1268	WerFault.exe	1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87.exe
2056	1268	WerFault.exe	1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87.exe

C:\Users\Admin\AppData\Local\Temp\1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87.exe
"C:\Users\Admin\AppData\Local\Temp\1a8aedf2bafbdcfa4a9eed9ca7e57ebe7183063f40f5991df5e46d07da074d87.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 412
2⤵
- Program crash
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 456
2⤵
- Program crash
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 716
2⤵
- Program crash
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1268 -ip 1268
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1268 -ip 1268
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1268 -ip 1268
1⤵
PID:1920

memory/1268-132-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download