c8090e429de130adcbc7221597d75016010219184d85d69bb08b1e30e22aadfe

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 02:54

Target

c8090e429de130adcbc7221597d75016010219184d85d69bb08b1e30e22aadfe.exe
Size

99KB
MD5

0dd5dd69bf049350b3d53b0c2424b040
SHA1

d01c06a373b0d22eebcac66e6d9ba8c445e509af
SHA256

c8090e429de130adcbc7221597d75016010219184d85d69bb08b1e30e22aadfe
SHA512

21f5a1df4ed8ed8390d841708b7cd7b3b83cf58edff4c028cd001079bb139af438a5218e76f620cfcec6a2244c80916913ee86a7be3cdadb5467e751f89dd360
SSDEEP

1536:rYboqTD+eIs7cgFXrKaqSWoiRdfYKuFDUnT+WkTT6cklMDf6V:rYIjgpK/SWoiRdfWUT+7/pMMDf

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5064	c8090e429de130adcbc7221597d75016010219184d85d69bb08b1e30e22aadfe.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5088	5064	WerFault.exe	80

C:\Users\Admin\AppData\Local\Temp\c8090e429de130adcbc7221597d75016010219184d85d69bb08b1e30e22aadfe.exe
"C:\Users\Admin\AppData\Local\Temp\c8090e429de130adcbc7221597d75016010219184d85d69bb08b1e30e22aadfe.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 504
  2⤵
  - Program crash
  PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5064 -ip 5064
1⤵
PID:4904

memory/5064-133-0x0000000000AD0000-0x0000000000AE9000-memory.dmp

Filesize
100KB

Download
memory/5064-132-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5064-134-0x0000000000AD0000-0x0000000000AE9000-memory.dmp

Filesize
100KB

Download