c322f60b17310a22198e89a3ad13602e6503435f991b2a0ce9f4ac179013b8b9

Analysis

max time kernel
112s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 18:12

Target

c322f60b17310a22198e89a3ad13602e6503435f991b2a0ce9f4ac179013b8b9.exe
Size

73KB
MD5

5dc524a59a822645556850248aa32a16
SHA1

cfad1ba8100d0b7f9c6dc1bfa72f6f5089afd97c
SHA256

c322f60b17310a22198e89a3ad13602e6503435f991b2a0ce9f4ac179013b8b9
SHA512

8a03ff752a24a5e916da328cb65f55b8aea35c587133e1393049a3facf8e7d6d77ba07bccdeff03749b94a7f4bdae7990747cbc5b8c573f3016f3586c4adb035
SSDEEP

1536:NOtgk7mT8snxZCBgcpUTihp89lEarihxJmsP:8gku0pUeircxJD

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4088	c322f60b17310a22198e89a3ad13602e6503435f991b2a0ce9f4ac179013b8b9.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4924	4088	WerFault.exe	78

C:\Users\Admin\AppData\Local\Temp\c322f60b17310a22198e89a3ad13602e6503435f991b2a0ce9f4ac179013b8b9.exe
"C:\Users\Admin\AppData\Local\Temp\c322f60b17310a22198e89a3ad13602e6503435f991b2a0ce9f4ac179013b8b9.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 544
  2⤵
  - Program crash
  PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4088 -ip 4088
1⤵
PID:1556

memory/4088-132-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4088-133-0x0000000000A10000-0x0000000000A29000-memory.dmp

Filesize
100KB

Download
memory/4088-134-0x0000000000A10000-0x0000000000A29000-memory.dmp

Filesize
100KB

Download