7ba33e0bc912046a6193032bf873b82d5ad53de7aa1580a70f7981d0bfbe069d

Analysis

max time kernel
182s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 02:53

Target

7ba33e0bc912046a6193032bf873b82d5ad53de7aa1580a70f7981d0bfbe069d.exe
Size

83KB
MD5

21b06df695ea9e8fae7ab503ab163290
SHA1

2d7f04df3ba480f79c8d69c910275e5fe4cb6796
SHA256

7ba33e0bc912046a6193032bf873b82d5ad53de7aa1580a70f7981d0bfbe069d
SHA512

86fd3cba3c2d55d5428cbb1cf3deca809ead91f71e95331cb160c2b37a6a940ce2f2fd90b90d0e6d41f09bfa96cd0cac5f1d83579a2d2cc85225b97d734e7cb2
SSDEEP

1536:iz2T8BEsgwLhTBzgSNoiScpnG1qGo6mizSvnRWfhPT37apdEJX3F/:eBRNngSNointgBo6xSPR6jgdEJX1/

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4380	7ba33e0bc912046a6193032bf873b82d5ad53de7aa1580a70f7981d0bfbe069d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4248	4380	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\7ba33e0bc912046a6193032bf873b82d5ad53de7aa1580a70f7981d0bfbe069d.exe
"C:\Users\Admin\AppData\Local\Temp\7ba33e0bc912046a6193032bf873b82d5ad53de7aa1580a70f7981d0bfbe069d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 512
  2⤵
  - Program crash
  PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4380 -ip 4380
1⤵
PID:2116

memory/4380-132-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4380-133-0x0000000002270000-0x0000000002289000-memory.dmp

Filesize
100KB

Download
memory/4380-134-0x0000000002270000-0x0000000002289000-memory.dmp

Filesize
100KB

Download