51e923d1f56a34c668e2f1d5e6e6d2751a3fa9b6f772dfa44f71c9a4f4ad47bd

Analysis

max time kernel
184s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 04:32

Target

51e923d1f56a34c668e2f1d5e6e6d2751a3fa9b6f772dfa44f71c9a4f4ad47bd.exe
Size

104KB
MD5

9b39c62a3880483c6b6c3a43c9ce79ce
SHA1

9e6e344f9390022e9cac676fb61aeec20f7fc0ea
SHA256

51e923d1f56a34c668e2f1d5e6e6d2751a3fa9b6f772dfa44f71c9a4f4ad47bd
SHA512

07dd26509102b07c3ab40270dc72b56ee9c2f1ea4db105059b633feb1187aaca3e9246b086f76edad48d6d8d5827b7162cb1f924685d7846b93154dd7451c6de
SSDEEP

1536:8jz9uWp5TyYTxdNTuSgxmVoFwLSoAi1lwteyHKCqHfdDKRHTHRHTYRHT:8jz9lHNXgxmVoFJ0lwKflmdTdEd

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4320	51e923d1f56a34c668e2f1d5e6e6d2751a3fa9b6f772dfa44f71c9a4f4ad47bd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4796	4320	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\51e923d1f56a34c668e2f1d5e6e6d2751a3fa9b6f772dfa44f71c9a4f4ad47bd.exe
"C:\Users\Admin\AppData\Local\Temp\51e923d1f56a34c668e2f1d5e6e6d2751a3fa9b6f772dfa44f71c9a4f4ad47bd.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 552
  2⤵
  - Program crash
  PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4320 -ip 4320
1⤵
PID:1540

memory/4320-132-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4320-133-0x0000000000590000-0x0000000000598000-memory.dmp

Filesize
32KB

Download
memory/4320-134-0x0000000000590000-0x0000000000598000-memory.dmp

Filesize
32KB

Download