c5d5b30a9b67413749d046fb0aa5b074166483289890c7726386f88cc5c0fb60

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 02:40

Target

天彩助手.exe
Size

3.3MB
MD5

3e71c0d8c39694bed259f8f1d112e043
SHA1

cc866d4db2e031d30c82dae5e963472e65032f34
SHA256

4a2aee3e97f80bd472fb5ded8f9cbf0ccc1be14f335528b70b5607b2abed9527
SHA512

b16d0b3f0633b33c58a657247b9d5680e10a3c666b486a18e2e6697489997707d6249f1757d2685f735fa73f0f0725a18f66868056140295db4ba205d8591e3f
SSDEEP

98304:nh8ZQovi9Bv58hrFne6vxZtA9PQiLkRTk:Ai9Bv589I6vxvArLX

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3984	1452	WerFault.exe	94

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1452	天彩助手.exe
Token: SeIncBasePriorityPrivilege	1452	天彩助手.exe

Suspicious use of SetWindowsHookEx 6 IoCs

C:\Users\Admin\AppData\Local\Temp\天彩助手.exe
"C:\Users\Admin\AppData\Local\Temp\天彩助手.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 1780
  2⤵
  - Program crash
  PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1452 -ip 1452
1⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4144

memory/1452-0-0x0000000000400000-0x0000000000AC8000-memory.dmp

Filesize
6.8MB

Download
memory/1452-1-0x0000000000400000-0x0000000000AC8000-memory.dmp

Filesize
6.8MB

Download
memory/1452-2-0x0000000000D80000-0x0000000000D88000-memory.dmp

Filesize
32KB

Download
memory/1452-3-0x0000000000400000-0x0000000000AC8000-memory.dmp

Filesize
6.8MB

Download
memory/1452-11-0x0000000000400000-0x0000000000AC8000-memory.dmp

Filesize
6.8MB

Download
memory/1452-12-0x0000000000400000-0x0000000000AC8000-memory.dmp

Filesize
6.8MB

Download