b32f9f97f7d414e13f0c5a791d1d26dae0b8b02cbc0a8632216b9ca05d25e356

Analysis

max time kernel
138s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2023 13:17

Target

b32f9f97f7d414e13f0c5a791d1d26dae0b8b02cbc0a8632216b9ca05d25e356.exe
Size

6.3MB
MD5

9b7180d5a20298545e8aaa5d16932559
SHA1

6afd8f0fa782e31b8d584690f784cdf2b905e14e
SHA256

b32f9f97f7d414e13f0c5a791d1d26dae0b8b02cbc0a8632216b9ca05d25e356
SHA512

6ac0e5dccda0fb50fa1bf2bb21877e7d12f6b16f462ff9117cb35f2acf7f9cf107dc98f0c69061646deb42f5566f2aa17b796fefb0b3c47f039506eaddf251f4
SSDEEP

98304:A2N78y36s9+dpf4YI1pdqvXzS35oAIJrHeUFRU3WjmpZBXr8b24tQtvPmQu:pAyF9+c31pdq+356LeUU3gmpW2622Qu

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2032	b32f9f97f7d414e13f0c5a791d1d26dae0b8b02cbc0a8632216b9ca05d25e356.exe
2032	b32f9f97f7d414e13f0c5a791d1d26dae0b8b02cbc0a8632216b9ca05d25e356.exe
2032	b32f9f97f7d414e13f0c5a791d1d26dae0b8b02cbc0a8632216b9ca05d25e356.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4308	2032	WerFault.exe	87

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	b32f9f97f7d414e13f0c5a791d1d26dae0b8b02cbc0a8632216b9ca05d25e356.exe

C:\Users\Admin\AppData\Local\Temp\b32f9f97f7d414e13f0c5a791d1d26dae0b8b02cbc0a8632216b9ca05d25e356.exe
"C:\Users\Admin\AppData\Local\Temp\b32f9f97f7d414e13f0c5a791d1d26dae0b8b02cbc0a8632216b9ca05d25e356.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 224
  2⤵
  - Program crash
  PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2032 -ip 2032
1⤵
PID:4132

memory/2032-0-0x0000000000400000-0x0000000001CA8000-memory.dmp

Filesize
24.7MB

Download
memory/2032-3-0x0000000000400000-0x0000000001CA8000-memory.dmp

Filesize
24.7MB

Download