5aaba99a95ed2702722af7f2bc854455d2d66de1884d378d35f48816509bda94

Analysis

max time kernel
170s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 04:50

Target

5aaba99a95ed2702722af7f2bc854455d2d66de1884d378d35f48816509bda94.exe
Size

124KB
MD5

9743dee8e1ef3313e8ff365cfc036674
SHA1

c977e211a06d8f832eb3a62e68860345ca436c4c
SHA256

5aaba99a95ed2702722af7f2bc854455d2d66de1884d378d35f48816509bda94
SHA512

77b27cdb01a3487ad883f8e39e5f8aa222c7b9cacb0940f0ea7e725d4cbc52f45ad7d76ebefc61e71a3ec11d8f0b499d3f7610de946cb1b4701ea7d02971503d
SSDEEP

1536:ECP5xTTyNjfRTUECMUxr5MhvM3oraPJ8Km5m7rcC7/siP7:hP5xTcT6mM3o6J8KVr/0

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4632	5aaba99a95ed2702722af7f2bc854455d2d66de1884d378d35f48816509bda94.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	4632	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\5aaba99a95ed2702722af7f2bc854455d2d66de1884d378d35f48816509bda94.exe
"C:\Users\Admin\AppData\Local\Temp\5aaba99a95ed2702722af7f2bc854455d2d66de1884d378d35f48816509bda94.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 476
  2⤵
  - Program crash
  PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4632 -ip 4632
1⤵
PID:100

memory/4632-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4632-133-0x00000000009E0000-0x0000000000A17000-memory.dmp

Filesize
220KB

Download
memory/4632-134-0x00000000009E0000-0x0000000000A17000-memory.dmp

Filesize
220KB

Download