57b8b23f49955ea7c0c8ca280b0171a46b54ae730d59d22880aacf9df68ffee7

Analysis

max time kernel
61s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 05:00

Target

57b8b23f49955ea7c0c8ca280b0171a46b54ae730d59d22880aacf9df68ffee7.exe
Size

128KB
MD5

12f492984db7e075fc3a4aebd35567a0
SHA1

ebbf2f78143de0d483113d91f83e46c2c8f9369d
SHA256

57b8b23f49955ea7c0c8ca280b0171a46b54ae730d59d22880aacf9df68ffee7
SHA512

5553f25da338bef1bb6679888cd856f47b3b3ecca31ef16a780feb9d9d4e84c3b623f099ecc534c0e4b5be6d6105f1bc74147c3d01e42b626afd42c9dcf1010d
SSDEEP

3072:c392kaPn8/wf3R6wZg2CEZyxeEqtOoecMqTxLbz:couQBS5EZyxnefeFq

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1960	57b8b23f49955ea7c0c8ca280b0171a46b54ae730d59d22880aacf9df68ffee7.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3540	1960	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\57b8b23f49955ea7c0c8ca280b0171a46b54ae730d59d22880aacf9df68ffee7.exe
"C:\Users\Admin\AppData\Local\Temp\57b8b23f49955ea7c0c8ca280b0171a46b54ae730d59d22880aacf9df68ffee7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 400
  2⤵
  - Program crash
  PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1960 -ip 1960
1⤵
PID:2804

memory/1960-132-0x0000000000400000-0x000000000144C000-memory.dmp

Filesize
16.3MB

Download
memory/1960-133-0x0000000000400000-0x000000000144C000-memory.dmp

Filesize
16.3MB

Download
memory/1960-134-0x0000000000400000-0x000000000144C000-memory.dmp

Filesize
16.3MB

Download