687d864dcce69998000c85f39d4eb2b2798d3151784c7fa4cd829887646fef78

Analysis

max time kernel
153s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 23:10

Target

687d864dcce69998000c85f39d4eb2b2798d3151784c7fa4cd829887646fef78.exe
Size

111KB
MD5

94054552efa6ed9baf4ca307cd36a339
SHA1

4226f1e2d303585d270fecb7dccea33ef7f18f33
SHA256

687d864dcce69998000c85f39d4eb2b2798d3151784c7fa4cd829887646fef78
SHA512

52aad395153638a0f8d06e5003de16236b21c124a1ca558ae00f39e233bbea9ffad1c134d26e723e09fcd1b3373425392eeb28cfd1f5992092f039bc75c33292
SSDEEP

1536:cRhl5LYqPKFT44DacOQ0GpKmj6so2QdQAaenEpZkmA7NCGJo:cRhzLY32cXKmj6so2QdsMB

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4924	687d864dcce69998000c85f39d4eb2b2798d3151784c7fa4cd829887646fef78.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4560	4924	WerFault.exe	79

C:\Users\Admin\AppData\Local\Temp\687d864dcce69998000c85f39d4eb2b2798d3151784c7fa4cd829887646fef78.exe
"C:\Users\Admin\AppData\Local\Temp\687d864dcce69998000c85f39d4eb2b2798d3151784c7fa4cd829887646fef78.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 492
  2⤵
  - Program crash
  PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4924 -ip 4924
1⤵
PID:4812

memory/4924-132-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4924-133-0x00000000005F0000-0x0000000000609000-memory.dmp

Filesize
100KB

Download
memory/4924-134-0x00000000005F0000-0x0000000000609000-memory.dmp

Filesize
100KB

Download