c6c35515e39ecfdd43e9d1709948b996950ad3277a4db957c77a16e97862ffe3

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-it
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-itlocale:it-itos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:31

Target
KellerGuard.exe
Size 31.9MB
Sample260804-nm7cfavvhs
SHA256 c6c35515e39ecfdd43e9d1709948b996950ad3277a4db957c77a16e97862ffe3
MD5 8459b73795e2d7a4800938877d223da0
SHA1 0f8b166880b48058a84ef7a46edf4dafd7835142
SHA512 3ebd6dfb0d3fc73b0aaae023387b6eb42898dba3c300a5c99499cb76defb7327faac5a7788710e28cdaa405b88323c3d008dea9bd5c4583ac14716bf9b7bbb7d
SSDEEP 786432:Zt+LhTUgB0nv7NQM395aS+1uLfWtDsE6:W2gM/t8S+mM4z
TLSH
T1937723A6A5D563D88FC30484734E53DB21C1687E85EE58383ACB6C029630DFF658ADB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2552	KellerGuard.exe
2552	KellerGuard.exe

C:\Users\Admin\AppData\Local\Temp\KellerGuard.exe
"C:\Users\Admin\AppData\Local\Temp\KellerGuard.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2552