612c97e4d9d929a094826d134e15e6cf3a00668cce434a9a70525f7ab09f240d

Analysis

max time kernel
190s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 23:26

Target

612c97e4d9d929a094826d134e15e6cf3a00668cce434a9a70525f7ab09f240d.exe
Size

58KB
MD5

55ad67cae98bd2c03245b3ebe548036e
SHA1

87a191dd2a972cd95f9e8e01d9e9228c5a6087f1
SHA256

612c97e4d9d929a094826d134e15e6cf3a00668cce434a9a70525f7ab09f240d
SHA512

c0b6e0835992462a9ec45efa88327ad8e4fe22923c4aaf5b9c11fc108e7a77b170eef9315ddf1a37570e905b61ba56033a248317c7a04c293a2f18a7ed9fe36d
SSDEEP

1536:MndEVw7aXA/S8nACBuoZB5FfqGSnw8xiMFvKymlfJr:MndEiUA/S8CoZPovxip/lfJ

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1064	612c97e4d9d929a094826d134e15e6cf3a00668cce434a9a70525f7ab09f240d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4604	1064	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\612c97e4d9d929a094826d134e15e6cf3a00668cce434a9a70525f7ab09f240d.exe
"C:\Users\Admin\AppData\Local\Temp\612c97e4d9d929a094826d134e15e6cf3a00668cce434a9a70525f7ab09f240d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 404
  2⤵
  - Program crash
  PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1064 -ip 1064
1⤵
PID:2420

memory/1064-132-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1064-133-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1064-134-0x0000000000590000-0x00000000005A9000-memory.dmp

Filesize
100KB

Download
memory/1064-135-0x0000000000590000-0x00000000005A9000-memory.dmp

Filesize
100KB

Download