ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac

Analysis

max time kernel
149s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:37

Target

ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe
Size

127KB
MD5

69dd37434c1bfc45cb788f98876d1a58
SHA1

24c4af82ffd278f066b546a109fdcc8d2fca1cc2
SHA256

ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac
SHA512

19b734c858da3bc350c27ac924bd9f60aeb8a26c3492b97ee7764f5b5f330c547e61c90b3092b388df25c9b2e3216610d123ae44201201bbcfac03e33905b03f
SSDEEP

3072:2LH/PmVJZubah/hZnIweLZz5lOBscF3o4P:2r+VJcqhFkLZNy3bP

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1128	ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	1128	WerFault.exe	79

C:\Users\Admin\AppData\Local\Temp\ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe
"C:\Users\Admin\AppData\Local\Temp\ce29dc2eb0dc01869c94fd19f1c8cad933b10522bbdb51d0479c22300e4bceac.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 228
  2⤵
  - Program crash
  PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1128 -ip 1128
1⤵
PID:2708

memory/1128-132-0x0000000001000000-0x0000000001021F1E-memory.dmp

Filesize
135KB

Download