eed7f95ff86ee83f7da04b28ecce4a6faafab72d15ddf651df1d95e4a5067a34

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 14:58

Target

3d26ca4dd59b7aab87a845eac30336b1.exe
Size

457KB
MD5

3d26ca4dd59b7aab87a845eac30336b1
SHA1

c5aa1db2856e382db1a7f5eb7956bcf2ff62b780
SHA256

eed7f95ff86ee83f7da04b28ecce4a6faafab72d15ddf651df1d95e4a5067a34
SHA512

32b5c159440d7d91cde7b6c45b0ee5ca3b54f50bdeaaa7cc3e5ff9470b0f9ebdeea2d5ab87d389b6f327769fc1a98f94fadec3d7aee7971fe56a096120c67b2f
SSDEEP

12288:qw4CBYmPwys9XEfNaroH/BFCggtvFxpZ3zEqap:5BrP0ySNggtjpZjEq

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3660	3d26ca4dd59b7aab87a845eac30336b1.exe
3660	3d26ca4dd59b7aab87a845eac30336b1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1684	3660	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\3d26ca4dd59b7aab87a845eac30336b1.exe
"C:\Users\Admin\AppData\Local\Temp\3d26ca4dd59b7aab87a845eac30336b1.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 472
  2⤵
  - Program crash
  PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3660 -ip 3660
1⤵
PID:1956

memory/3660-0-0x0000000000400000-0x00000000004D9BE1-memory.dmp

Filesize
870KB

Download
memory/3660-1-0x00000000004C2000-0x00000000004DA000-memory.dmp

Filesize
96KB

Download
memory/3660-2-0x00000000004C2000-0x00000000004DA000-memory.dmp

Filesize
96KB

Download
memory/3660-3-0x0000000000400000-0x00000000004D9BE1-memory.dmp

Filesize
870KB

Download
memory/3660-4-0x0000000000400000-0x00000000004D9BE1-memory.dmp

Filesize
870KB

Download