ed91e67b7ac14eb706795925e33102926a178b84985ad7b2606b4afe73f4e650

Analysis

max time kernel
121s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 08:35

Target

ed91e67b7ac14eb706795925e33102926a178b84985ad7b2606b4afe73f4e650.exe
Size

102KB
MD5

50532a6e6faa001aaaa1c8067ea81910
SHA1

f0351bd37acd77fef1fb9eed239a4e52e0d01b2a
SHA256

ed91e67b7ac14eb706795925e33102926a178b84985ad7b2606b4afe73f4e650
SHA512

24d765d0dd6374370de5f1b7b693f18b6bcd8b5190c814a2eff3b3393e8c625ef9b7a0cd2107f4b6dd48c99d204b80e7663d45b3126adffb03d39c3aaa2abe15
SSDEEP

3072:ka4GvOcgSzBKMsxm4+oo+3Wq1pxOYjDvpp:kxcrq8YjVp

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5076	ed91e67b7ac14eb706795925e33102926a178b84985ad7b2606b4afe73f4e650.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	5076	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\ed91e67b7ac14eb706795925e33102926a178b84985ad7b2606b4afe73f4e650.exe
"C:\Users\Admin\AppData\Local\Temp\ed91e67b7ac14eb706795925e33102926a178b84985ad7b2606b4afe73f4e650.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 508
  2⤵
  - Program crash
  PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5076 -ip 5076
1⤵
PID:5028

memory/5076-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5076-133-0x00000000004B0000-0x00000000004C9000-memory.dmp

Filesize
100KB

Download
memory/5076-134-0x00000000004B0000-0x00000000004C9000-memory.dmp

Filesize
100KB

Download