08eb4183f2f67f4ca441e76d4f6cbc3edde1747c79bbcdb74384b7647bce5725

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 03:26

Target

0ce9321d2dc4bc1fe1a3b9836807b80a.exe
Size

378KB
MD5

0ce9321d2dc4bc1fe1a3b9836807b80a
SHA1

a4f6bc6b84301eae2cb2eeb2ca1046b3b37f3559
SHA256

08eb4183f2f67f4ca441e76d4f6cbc3edde1747c79bbcdb74384b7647bce5725
SHA512

aedb50fe0fb72861e936759a65a8e84a953b6a127566456a8803e01ab622ddb0d36b8c7027a4acbe988ba437e91307cb9f388382d4a9815756d92ec36e2e9b05
SSDEEP

6144:APahDZea7hrFz5ID7jplcYCDdVBByllXAUG0wDNJpJipaoplYi++O8sojuhg:A2D7hrFz5IDJOjm34fXi9pPQ8soj

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4640	0ce9321d2dc4bc1fe1a3b9836807b80a.exe
4640	0ce9321d2dc4bc1fe1a3b9836807b80a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	4640	WerFault.exe	45

C:\Users\Admin\AppData\Local\Temp\0ce9321d2dc4bc1fe1a3b9836807b80a.exe
"C:\Users\Admin\AppData\Local\Temp\0ce9321d2dc4bc1fe1a3b9836807b80a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 328
  2⤵
  - Program crash
  PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4640 -ip 4640
1⤵
PID:4976

memory/4640-1-0x0000000000400000-0x00000000004DC868-memory.dmp

Filesize
882KB

Download
memory/4640-0-0x00000000004BF000-0x00000000004DD000-memory.dmp

Filesize
120KB

Download
memory/4640-2-0x00000000004BF000-0x00000000004DD000-memory.dmp

Filesize
120KB

Download
memory/4640-3-0x0000000000400000-0x00000000004DC868-memory.dmp

Filesize
882KB

Download