b99cffdef58d4d86fd504e95bed3c72fb330d7a9ac9e017c503bbbdd5540aa1a

Analysis

max time kernel
106s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 19:42

Target

b99cffdef58d4d86fd504e95bed3c72fb330d7a9ac9e017c503bbbdd5540aa1a.exe
Size

58KB
MD5

55754081374839094549b2c3a7de48eb
SHA1

9655f947a57f7a58b8bab0e223e59a38c9edb8ac
SHA256

b99cffdef58d4d86fd504e95bed3c72fb330d7a9ac9e017c503bbbdd5540aa1a
SHA512

8e34d466ade463a563c0119b0fddc1c3c69003d8e4bd238ff23689bfa71bef25cedd0912426ea617e6dcad8c9ea0ff97660aaac50ed8c6d44cd74ebc27ed8fee
SSDEEP

1536:tByv8PT5o71ehn5AY4/OXxXyXXO3BfNyjjjjjjuU8J:tByvGy7185TuugXXKfPUc

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2348	b99cffdef58d4d86fd504e95bed3c72fb330d7a9ac9e017c503bbbdd5540aa1a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3028	2348	WerFault.exe	81

C:\Users\Admin\AppData\Local\Temp\b99cffdef58d4d86fd504e95bed3c72fb330d7a9ac9e017c503bbbdd5540aa1a.exe
"C:\Users\Admin\AppData\Local\Temp\b99cffdef58d4d86fd504e95bed3c72fb330d7a9ac9e017c503bbbdd5540aa1a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 936
  2⤵
  - Program crash
  PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2348 -ip 2348
1⤵
PID:2128

memory/2348-132-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2348-133-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2348-134-0x00000000021D0000-0x00000000021E9000-memory.dmp

Filesize
100KB

Download
memory/2348-135-0x00000000021D0000-0x00000000021E9000-memory.dmp

Filesize
100KB

Download