3a050ca26d2d6df2f1c7637ddc7e7b473c25868a6a5c2b0c7b682c5ce17669db

Analysis

max time kernel
144s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 14:38

Target

3a0fcbfd85e3ffe98f98e5744c5d59c5.exe
Size

409KB
MD5

3a0fcbfd85e3ffe98f98e5744c5d59c5
SHA1

0c3fe76b7f10176f643d39e0ab2f94a83e51aa45
SHA256

3a050ca26d2d6df2f1c7637ddc7e7b473c25868a6a5c2b0c7b682c5ce17669db
SHA512

7c7906b807aa60717f89f4ac49bcb087257e85882549341f330cc9c3a778c0a47003887e081d95d3a0c59701ed97b36adf304bb0e653238413f21c240261326f
SSDEEP

6144:5wvEjjNKTluluytaiHVUjTk+eblo015+apcJ0U0xLBC0b3:6sjjlIyp1UG5oq+apOn0xoy3

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4172	3a0fcbfd85e3ffe98f98e5744c5d59c5.exe
4172	3a0fcbfd85e3ffe98f98e5744c5d59c5.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3640	4172	WerFault.exe	16

C:\Users\Admin\AppData\Local\Temp\3a0fcbfd85e3ffe98f98e5744c5d59c5.exe
"C:\Users\Admin\AppData\Local\Temp\3a0fcbfd85e3ffe98f98e5744c5d59c5.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 140
  2⤵
  - Program crash
  PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4172 -ip 4172
1⤵
PID:3892

memory/4172-2-0x00000000004AE000-0x00000000004C5000-memory.dmp

Filesize
92KB

Download
memory/4172-1-0x00000000004AE000-0x00000000004C5000-memory.dmp

Filesize
92KB

Download
memory/4172-0-0x0000000000400000-0x00000000004C4897-memory.dmp

Filesize
786KB

Download
memory/4172-3-0x0000000000400000-0x00000000004C4897-memory.dmp

Filesize
786KB

Download