a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 08:55

Target

a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9.exe
Size

2.9MB
MD5

b9a76f69b1a14b2613db868e335c1f16
SHA1

25cc9e120f4a7aec009879bcde170d7805caf47e
SHA256

a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9
SHA512

5eb05d8fa4d538bcc69a168ab786ff02b36787456fa8e9e0380c4542ff665f167ffe54b681343562302d64067a5161b05da6de5d1b9b5f16dca0303ee0e59865
SSDEEP

49152:rprWd7mexCIEmkSbBU/ncoTmEvF8NZy7WQn4JJ4B64k2Id0+GoQOpaAqs0W09afg:VWhN7dkSNUn/7vmbyCQr64k2Id0+GoQ

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1168	a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9.exe
1168	a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9.exe
1168	a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1560	1168	WerFault.exe	82

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1168	a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9.exe
1168	a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9.exe
1168	a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9.exe
1168	a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9.exe

C:\Users\Admin\AppData\Local\Temp\a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9.exe
"C:\Users\Admin\AppData\Local\Temp\a533dcaca3d9160f3bf7c415cd5ae4fb076c8cb8a0078de348ccfd526af358b9.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 296
  2⤵
  - Program crash
  PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1168 -ip 1168
1⤵
PID:4168

memory/1168-0-0x0000000000400000-0x0000000000999000-memory.dmp

Filesize
5.6MB

Download
memory/1168-1-0x0000000000400000-0x0000000000999000-memory.dmp

Filesize
5.6MB

Download
memory/1168-2-0x0000000002DA0000-0x0000000002DA8000-memory.dmp

Filesize
32KB

Download
memory/1168-3-0x0000000000400000-0x0000000000999000-memory.dmp

Filesize
5.6MB

Download