e275e8febf42d63d37ded05b4e6aacc1b36b9ace6318cd09d65b822037464c37

Analysis

max time kernel
136s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 06:28

Target

$SYSDIR/PassGuardX64ForYBXY/PassGuardX64.dll
Size

3.3MB
MD5

c51656b26119aacd1a46c0e0a595a39c
SHA1

b75d8b77297d2fd7f6f7763a3d50ea06beb396e6
SHA256

665e7de614a196741af1a52b48f91453136d0bce3e0048699b3b115e3c7078b9
SHA512

a2a3747dc518249599097bec700cb09b1551b6d9052d0225f5e4abf2d458acff6edd4867db81685bb94c71c6dc5302f868be8de170ca6804ab79288c5a5afaf7
SSDEEP

49152:WYbgS0xNu63rtrgwNAOa1qXEeaenHgJEomipl4LgziNXfzEurRnKtAGeXbyg10:WYS5aG7onlw75fzE+RKtALLyy0

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2080	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\PassGuardX64ForYBXY\PassGuardX64.dll
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3908,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=1052 /prefetch:8
1⤵
PID:2880

memory/2080-0-0x00007FFBEE510000-0x00007FFBEE85C000-memory.dmp

Filesize
3.3MB

Download
memory/2080-1-0x00007FFBEE833000-0x00007FFBEE834000-memory.dmp

Filesize
4KB

Download