4935dbb127d3a2bd15b45b6680e21f156d5227d60b9fa87dbc36ccce053529a6

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 23:57

Target

4935dbb127d3a2bd15b45b6680e21f156d5227d60b9fa87dbc36ccce053529a6.exe
Size

58KB
MD5

fb0b9ce22fb5f20dda1297d67a5439cf
SHA1

9eaa4a4f427e52ad2a9716abfae1b21d31e5dc3c
SHA256

4935dbb127d3a2bd15b45b6680e21f156d5227d60b9fa87dbc36ccce053529a6
SHA512

8483f4ae2ddcf2b04e0b1334034039b54d958b9ef93499cf76b64ada8f60abb072f3d4c4e573b63579abc51f6478e859966dc1c6484586a2e396dccfb004b461
SSDEEP

1536:ui4BAVsJpVOSEYPPwYYLUis5um5D9/5IcnJ5MiL:uiU+YNh1uPWuo1J9

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4180	4935dbb127d3a2bd15b45b6680e21f156d5227d60b9fa87dbc36ccce053529a6.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	4180	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\4935dbb127d3a2bd15b45b6680e21f156d5227d60b9fa87dbc36ccce053529a6.exe
"C:\Users\Admin\AppData\Local\Temp\4935dbb127d3a2bd15b45b6680e21f156d5227d60b9fa87dbc36ccce053529a6.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 412
  2⤵
  - Program crash
  PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4180 -ip 4180
1⤵
PID:3112

memory/4180-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4180-132-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4180-134-0x0000000000880000-0x0000000000899000-memory.dmp

Filesize
100KB

Download
memory/4180-135-0x0000000000880000-0x0000000000899000-memory.dmp

Filesize
100KB

Download