91c6b4f5c3cd3193002a569a789d2dd18432597c138ef2e4352b3a5d9b2b12f9

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09/10/2023, 12:31

Target

91c6b4f5c3cd3193002a569a789d2dd18432597c138ef2e4352b3a5d9b2b12f9.exe
Size

2.8MB
MD5

4ac9db3d726bcc12c5da8800d0f609d6
SHA1

1b7899db68dbdd722967895e4900dc7d4ed24292
SHA256

91c6b4f5c3cd3193002a569a789d2dd18432597c138ef2e4352b3a5d9b2b12f9
SHA512

fa0da16a99733aeaba3673e717ed6acdaec98ab5f0918be4a036ce331aafd4c23fbd77c3a0d3891c12debfd27f6a37234129bc31996bfbadcf9aef3ec3fce160
SSDEEP

49152:cQGKcEDxpHxDDuevEBUkBIGG59AyscI9lcaMKgOAcF3dtaSCrL:SKcEDHH5DuwEBnBIGGD69MKVV3dYr

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
740	91c6b4f5c3cd3193002a569a789d2dd18432597c138ef2e4352b3a5d9b2b12f9.exe

C:\Users\Admin\AppData\Local\Temp\91c6b4f5c3cd3193002a569a789d2dd18432597c138ef2e4352b3a5d9b2b12f9.exe
"C:\Users\Admin\AppData\Local\Temp\91c6b4f5c3cd3193002a569a789d2dd18432597c138ef2e4352b3a5d9b2b12f9.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:740

memory/740-0-0x0000000000400000-0x00000000007A6000-memory.dmp

Filesize
3.6MB

Download
memory/740-1-0x0000000002410000-0x00000000024F2000-memory.dmp

Filesize
904KB

Download
memory/740-2-0x0000000000400000-0x00000000007A6000-memory.dmp

Filesize
3.6MB

Download
memory/740-3-0x0000000002410000-0x00000000024F2000-memory.dmp

Filesize
904KB

Download