5961145d2209c1782cbdba1dcec93ac6f22b84992e4da7f328cac949e9e6d337

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 15:05

Target

b4fe17829e25705262dcb4b41c1deacc.exe
Size

5.5MB
MD5

b4fe17829e25705262dcb4b41c1deacc
SHA1

1636f8392a31682cdb2b1d567c296c55d1962c6c
SHA256

5961145d2209c1782cbdba1dcec93ac6f22b84992e4da7f328cac949e9e6d337
SHA512

cde38814fcc766b451c2849e6d210ee4c036f458a26a7d02664374007537dcdb9d684908eb7a0048bbf28e1a09ce75f11ca73496632e067d3ea4e7d74b5995e9
SSDEEP

98304:FogsbIpXyqnDiGr3q77YQ/035fUAWDLYDFVWDnv28kebNyK0LOx2rH7cyV9ksU:FogWIpXyqnb3h5ftMn+EbYK0OkNV9kl

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
892	b4fe17829e25705262dcb4b41c1deacc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	892	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
892	b4fe17829e25705262dcb4b41c1deacc.exe
892	b4fe17829e25705262dcb4b41c1deacc.exe

C:\Users\Admin\AppData\Local\Temp\b4fe17829e25705262dcb4b41c1deacc.exe
"C:\Users\Admin\AppData\Local\Temp\b4fe17829e25705262dcb4b41c1deacc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 528
  2⤵
  - Program crash
  PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 892 -ip 892
1⤵
PID:1064

memory/892-0-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download
memory/892-1-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/892-3-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download
memory/892-2-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/892-4-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download
memory/892-7-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download