79d746ef667014e9232dc4bc41db2e8a040262bef2935f854ba4ba7314a52d4d

Resubmissions

19/07/2024, 21:15

19/07/2024, 21:09

max time kernel
99s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 21:15

Target

TheBindinofIsaaRebirth.v1.05/isaac-ng.exe
Size

2.6MB
MD5

abb297b2f727e9aa870f6216e693c706
SHA1

67a4530a84b5ea48752280f0488ff71dc34989f9
SHA256

527a575957b20371bb1a03d5983f1c5417728fc554649069131b3b72f3764597
SHA512

e9a3ef3154f6410bf7b39c8901479f9d57af14ebf78f4e0e8db31adc1c721b3f5cbb332209c6a201c26718427ea5b56c6f3862f40258eff8cec094b84cbdcbec
SSDEEP

49152:naHc6A4qN7IhwI8mEI4vJyY8uDiqBJBhz91sGWMfYDINd7wOR9vun4DqgOSPwabv:nTSggL8tIkyuf1WcY8TEORFuzgOSPDHJ

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4076	isaac-ng.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	4076	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4076	isaac-ng.exe
4076	isaac-ng.exe

C:\Users\Admin\AppData\Local\Temp\TheBindinofIsaaRebirth.v1.05\isaac-ng.exe
"C:\Users\Admin\AppData\Local\Temp\TheBindinofIsaaRebirth.v1.05\isaac-ng.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 844
  2⤵
  - Program crash
  PID:1320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4076 -ip 4076
1⤵
PID:3332

memory/4076-1-0x0000000002AD0000-0x0000000002B36000-memory.dmp

Filesize
408KB

Download
memory/4076-0-0x00000000007FF000-0x0000000000800000-memory.dmp

Filesize
4KB

Download
memory/4076-5-0x00000000005C0000-0x0000000000862000-memory.dmp

Filesize
2.6MB

Download
memory/4076-10-0x000000006B800000-0x000000006B88D000-memory.dmp

Filesize
564KB

Download