63cb19950de22e8df62147db79fc564a8d560e5c4c377c5988054d795f945556

Analysis

max time kernel
151s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 14:37

Target

63cb19950de22e8df62147db79fc564a8d560e5c4c377c5988054d795f945556.exe
Size

69KB
MD5

3e204ca172b28666a55411fa093729f0
SHA1

eca10cd236577c57dcfa853e0127b786e0e53f3b
SHA256

63cb19950de22e8df62147db79fc564a8d560e5c4c377c5988054d795f945556
SHA512

602f713f99bbc3a44d3f7861e8d411bbf0f9bc6b3813c1c434b784d0c93777406ba41c6e1f4ba70eb799f5ac614316ffb5c7b806286564fcda61d85f65b250e4
SSDEEP

1536:ZJk6w0lgaALGijbK4qiXcBc7fOwrcX+39:Zvg1yIDqXwcs

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5092	63cb19950de22e8df62147db79fc564a8d560e5c4c377c5988054d795f945556.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	5092	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\63cb19950de22e8df62147db79fc564a8d560e5c4c377c5988054d795f945556.exe
"C:\Users\Admin\AppData\Local\Temp\63cb19950de22e8df62147db79fc564a8d560e5c4c377c5988054d795f945556.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 400
  2⤵
  - Program crash
  PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5092 -ip 5092
1⤵
PID:1400

memory/5092-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5092-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5092-134-0x00000000001E0000-0x00000000001F9000-memory.dmp

Filesize
100KB

Download
memory/5092-135-0x00000000001E0000-0x00000000001F9000-memory.dmp

Filesize
100KB

Download