7a0d79f145e23c58c9188166476108e0216d891a17936e496e83fbaf8d41e03d

Analysis

max time kernel
88s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 17:22

Target

8fba99a9c714e606c9a163a693dae05a.exe
Size

383KB
MD5

8fba99a9c714e606c9a163a693dae05a
SHA1

b35f0821f4bce88e9171475adf2aa8afb76a79c1
SHA256

7a0d79f145e23c58c9188166476108e0216d891a17936e496e83fbaf8d41e03d
SHA512

e771fa42489e4390aeba803955dc165d548310d0cbe8b9b33854e7310b738f4a9696286aad70079cac849334c8e4462f650359ba56cc3b03f1da5ea6f549dd75
SSDEEP

6144:q/a2EdJZOQ0ojV26Pm9ABpKS91RfYx/g2GcBZBAjbKlbE0WrHZg6mtgPYbJN+:qSfZOQTV09ApdzRgxY2bvAjbgADFg6mz

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2976	8fba99a9c714e606c9a163a693dae05a.exe
2976	8fba99a9c714e606c9a163a693dae05a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3160	2976	WerFault.exe	86

C:\Users\Admin\AppData\Local\Temp\8fba99a9c714e606c9a163a693dae05a.exe
"C:\Users\Admin\AppData\Local\Temp\8fba99a9c714e606c9a163a693dae05a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 140
  2⤵
  - Program crash
  PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2976 -ip 2976
1⤵
PID:1560

memory/2976-1-0x0000000000400000-0x00000000004DC86D-memory.dmp

Filesize
882KB

Download
memory/2976-0-0x00000000004C4000-0x00000000004DD000-memory.dmp

Filesize
100KB

Download
memory/2976-2-0x00000000004C4000-0x00000000004DD000-memory.dmp

Filesize
100KB

Download
memory/2976-3-0x0000000000400000-0x00000000004DC86D-memory.dmp

Filesize
882KB

Download