97d48f383e013039325062f3c7d8348438eefd774ec656b843438dae7b9b276d

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 02:08

Target

5bdbe03c2eb0180cedf15dd3ea2120b2.exe
Size

150KB
MD5

5bdbe03c2eb0180cedf15dd3ea2120b2
SHA1

489ce701d49e635a30e632886cd584d2a7e667c1
SHA256

97d48f383e013039325062f3c7d8348438eefd774ec656b843438dae7b9b276d
SHA512

e024b3b6447aeae5d02b4aa3b1323bbdcf091726eca54de310c51b9da0ad8e47d9b792c20830ee3ac9b1a2ce36677e7656d6c7b77b925e1bf6a6c5367b40e100
SSDEEP

3072:gf+6sDSqN5rHxAM8wHN7mYIWNyyQ0xph3DVlykfXxX1Z41Ea35sP8D:N6sDSqrrBtw0xph3T9FiM

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4352	5bdbe03c2eb0180cedf15dd3ea2120b2.exe
4352	5bdbe03c2eb0180cedf15dd3ea2120b2.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	4352	WerFault.exe	64

C:\Users\Admin\AppData\Local\Temp\5bdbe03c2eb0180cedf15dd3ea2120b2.exe
"C:\Users\Admin\AppData\Local\Temp\5bdbe03c2eb0180cedf15dd3ea2120b2.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 220
  2⤵
  - Program crash
  PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4352 -ip 4352
1⤵
PID:4028

memory/4352-0-0x0000000013140000-0x0000000013179FEC-memory.dmp

Filesize
231KB

Download
memory/4352-1-0x0000000013164000-0x000000001317A000-memory.dmp

Filesize
88KB

Download
memory/4352-2-0x0000000013164000-0x000000001317A000-memory.dmp

Filesize
88KB

Download
memory/4352-3-0x0000000013140000-0x0000000013179FEC-memory.dmp

Filesize
231KB

Download