Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 15:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
412d9b507cec445b0b4ce5dc36cef697.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
412d9b507cec445b0b4ce5dc36cef697.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
412d9b507cec445b0b4ce5dc36cef697.exe
-
Size
885KB
-
MD5
412d9b507cec445b0b4ce5dc36cef697
-
SHA1
36e8fe5344fa2764763b28fda1ad5415d7820a34
-
SHA256
375c6a9c0dc6da7d32122269e5e5f7646f4b8e183b54e16fb55712cff89a416e
-
SHA512
a9e960809c96867e34953c5688a1f0b76f36078b42807e5ee0067445ea6678b68024dd52914ee283c27ef5041f6fb414d55557c5f3724879b8926589431495fc
-
SSDEEP
24576:a3d5DFVHW/HJ/3ThfSSTcUSQj4rOJwnx+9fbeT5SgghDu:ArDiJVNhwnx+Bbej0S
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5100 3864 WerFault.exe 46 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe 3864 412d9b507cec445b0b4ce5dc36cef697.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\412d9b507cec445b0b4ce5dc36cef697.exe"C:\Users\Admin\AppData\Local\Temp\412d9b507cec445b0b4ce5dc36cef697.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 5042⤵
- Program crash
PID:5100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3864 -ip 38641⤵PID:920