ef34863fc141afe4bf0e0f8d8640f511cbb5b0a56eceea887641881801f3ad87

Analysis

max time kernel
127s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 06:03

Target

ef34863fc141afe4bf0e0f8d8640f511cbb5b0a56eceea887641881801f3ad87.exe
Size

1.8MB
MD5

774758168900c8815a59edb0394d9c99
SHA1

2f21eae90c512f7dae083f0489ed2891984704a9
SHA256

ef34863fc141afe4bf0e0f8d8640f511cbb5b0a56eceea887641881801f3ad87
SHA512

2c39b0c18fbc42885e0b394dd079ccf5f5ef0f5db691aac5c7fc26165bda8cdf4e9fa1148c519189a1505acb63f5c8d93bff0432d57fcfb2261eb77c97f73c28
SSDEEP

49152:+xNwZ2XwvfD23F95Qs0jDcsez6Pl9JmPjznT1:SXgnuFYGePl9JOvnT1

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2620	ef34863fc141afe4bf0e0f8d8640f511cbb5b0a56eceea887641881801f3ad87.exe
2620	ef34863fc141afe4bf0e0f8d8640f511cbb5b0a56eceea887641881801f3ad87.exe
2620	ef34863fc141afe4bf0e0f8d8640f511cbb5b0a56eceea887641881801f3ad87.exe

C:\Users\Admin\AppData\Local\Temp\ef34863fc141afe4bf0e0f8d8640f511cbb5b0a56eceea887641881801f3ad87.exe
"C:\Users\Admin\AppData\Local\Temp\ef34863fc141afe4bf0e0f8d8640f511cbb5b0a56eceea887641881801f3ad87.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2620

memory/2620-0-0x0000000000400000-0x00000000006B9000-memory.dmp

Filesize
2.7MB

Download
memory/2620-1-0x0000000076C50000-0x0000000076E65000-memory.dmp

Filesize
2.1MB

Download
memory/2620-3875-0x0000000076420000-0x00000000765C0000-memory.dmp

Filesize
1.6MB

Download
memory/2620-5884-0x0000000075FE0000-0x000000007605A000-memory.dmp

Filesize
488KB

Download
memory/2620-13069-0x0000000000400000-0x00000000006B9000-memory.dmp

Filesize
2.7MB

Download