9ba54fb78b4c9f03e11b6fb8e49ad54000281a255d7ddc48b4cea179aea335c1

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/06/2023, 19:49

Target

clp6.exe
Size

5.2MB
MD5

3790dfbffb0ce76d9a747ad3c90f61ba
SHA1

ca543c85308d12a32c9a01b885847c55b69c0f22
SHA256

9ba54fb78b4c9f03e11b6fb8e49ad54000281a255d7ddc48b4cea179aea335c1
SHA512

ab963b7d19249ebd00b5fed0e4f8fdb18411f8d011953c77df31082dd035ad33a6ad1417db92d1db10e4f9fe5f592cb8395a4d8b746eb944eda3737553feba9a
SSDEEP

98304:T+JEMZKrb2IMkmCeCmG4ynnL7JslIopk/fXoeVJrWdnSC0Ecr7KoNl8ct5/xYDyI:iNCb2IMkmqmGnLN8IopgfoeVJrWdnvcU

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1220	clp6.exe
1220	clp6.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1224	1220	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1220	clp6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1224	1220	clp6.exe	27
PID 1220 wrote to memory of 1224	1220	clp6.exe	27
PID 1220 wrote to memory of 1224	1220	clp6.exe	27
PID 1220 wrote to memory of 1224	1220	clp6.exe	27

C:\Users\Admin\AppData\Local\Temp\clp6.exe
"C:\Users\Admin\AppData\Local\Temp\clp6.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 92
  2⤵
  - Program crash
  PID:1224

memory/1220-55-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1220-54-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1220-56-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1220-57-0x0000000000400000-0x0000000000943000-memory.dmp

Filesize
5.3MB

Download