9b42bc145f1c5b73ffbc2f836194e056dd2ce123e06690979e656d1f60a3f89c

Analysis

max time kernel
185s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 04:38

Target

9b42bc145f1c5b73ffbc2f836194e056dd2ce123e06690979e656d1f60a3f89c.exe
Size

98KB
MD5

b300cf496ce59525d639c1ec61ca9b5e
SHA1

c9730b434ebb718dd4b354538bf8d8ad55e69e14
SHA256

9b42bc145f1c5b73ffbc2f836194e056dd2ce123e06690979e656d1f60a3f89c
SHA512

c3935d59473be19441b520c00989c7806f5af2c7c698b23e5a578cf73642f7423036c94320e02c8f43649c0341d4aae5fbeeb4aadd0cce50ab5ec5254eebc950
SSDEEP

1536:vswig1cloTDJbSCjdYkTinq3fkvl0voOFwE0iwe41IQ7xcNcnIAoO4:EPg993Tiq8t0voOSti7KtNIAd4

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3036	9b42bc145f1c5b73ffbc2f836194e056dd2ce123e06690979e656d1f60a3f89c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1280	3036	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\9b42bc145f1c5b73ffbc2f836194e056dd2ce123e06690979e656d1f60a3f89c.exe
"C:\Users\Admin\AppData\Local\Temp\9b42bc145f1c5b73ffbc2f836194e056dd2ce123e06690979e656d1f60a3f89c.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 496
  2⤵
  - Program crash
  PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3036 -ip 3036
1⤵
PID:1880

memory/3036-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3036-133-0x00000000009E0000-0x0000000000A6D000-memory.dmp

Filesize
564KB

Download
memory/3036-134-0x00000000009E0000-0x0000000000A6D000-memory.dmp

Filesize
564KB

Download