c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 13:40

Target

c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb.exe
Size

56KB
MD5

3b8a64d5d87cb5f98501d90d1902c740
SHA1

179e1a4b5f6db94165943bc62a64856c8bb5789f
SHA256

c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb
SHA512

57972c6aafa0818cc03c440a953a03b1a368d8f79a9fd17c18a0b127c1edb854cf6a6a4eb3b8700feacc30d3a63a3f8371d0a3c2bd490682de9d3e93a20e0bf3
SSDEEP

1536:8xLDHfZJ75TUf9Xm96ehhpNA1JPcifA8cjW0:8xLDHfZl5EZm4r1JPbfpc

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4988	c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4744	4988	WerFault.exe	79

C:\Users\Admin\AppData\Local\Temp\c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb.exe
"C:\Users\Admin\AppData\Local\Temp\c42fa0ed880c89917a7b81e3816601c924cadba9abe9401b33ed618fc3f86bcb.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 408
  2⤵
  - Program crash
  PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4988 -ip 4988
1⤵
PID:4692

memory/4988-132-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4988-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4988-134-0x00000000001C0000-0x00000000001D9000-memory.dmp

Filesize
100KB

Download
memory/4988-135-0x00000000001C0000-0x00000000001D9000-memory.dmp

Filesize
100KB

Download