f4442aeb70fe73411c354bf52e516f189abc079b8eb1b061b2ecafe450d10c1a

Analysis

max time kernel
202s
max time network
221s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 11:29

Target

f4442aeb70fe73411c354bf52e516f189abc079b8eb1b061b2ecafe450d10c1a.exe
Size

125KB
MD5

f2e41c701f63eed19fe55627dc53cef8
SHA1

da39d0256d939c367f9d738d7ac88264b8036e50
SHA256

f4442aeb70fe73411c354bf52e516f189abc079b8eb1b061b2ecafe450d10c1a
SHA512

f41aa03086fc193613e957da468da7584e5b25f41d2d736edb391ebbd7afebf4f971edf795e31dc6ecbd5e8d9a8634c851865d8845b7880598fced0d9e535bb0
SSDEEP

1536:3Yiner01Mg4Dq2tYX185BMBUKIWuJsd8KsYUz4pXS7LsuqGWWpeBsCXKaJFw8bM:ILUX1cB6e3y8tz88NMBscjb7B

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1228	f4442aeb70fe73411c354bf52e516f189abc079b8eb1b061b2ecafe450d10c1a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4272	1228	WerFault.exe	79

C:\Users\Admin\AppData\Local\Temp\f4442aeb70fe73411c354bf52e516f189abc079b8eb1b061b2ecafe450d10c1a.exe
"C:\Users\Admin\AppData\Local\Temp\f4442aeb70fe73411c354bf52e516f189abc079b8eb1b061b2ecafe450d10c1a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 224
  2⤵
  - Program crash
  PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1228 -ip 1228
1⤵
PID:220

memory/1228-132-0x0000000001000000-0x00000000010218DC-memory.dmp

Filesize
134KB

Download
memory/1228-133-0x0000000001000000-0x00000000010218DC-memory.dmp

Filesize
134KB

Download