d8e1fb3339542d66a235d5e4b17c8a2e8e38a6bb63e31ad31f392ff19aa95711

Analysis

user interaction
yes
max time kernel
54s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 02:42

Target
1winresume.exe
Size 18.0MB
Sample260812-c7d1vaab49
SHA256 d8e1fb3339542d66a235d5e4b17c8a2e8e38a6bb63e31ad31f392ff19aa95711
MD5 93a4a3c7f7d06d9af650011ffb87ee65
SHA1 dd7a122f30f14d2af34c6f3322344a67a8809159
SHA512 460d0df3606f9cfff282873e5df1342e36c6d51ce902ab9f1cfe1a73ecbf69e7002e435929419042a2f8b0f5efc977dc8d31cca699b3a78765b81461f93251a5
SSDEEP 393216:TRoqmFVi0/mWALjOIe5nIWwLzNSdyg5GaCWUDT:TR9mFVi0O1/L0IWmoF4WI
TLSH
T1951723C73AEAF2ACC0831A4466C753CA25C065DE85E9891D35CF5C037425DAA8ACDBF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4052	1winresume.exe
4052	1winresume.exe

C:\Users\Admin\AppData\Local\Temp\1winresume.exe
"C:\Users\Admin\AppData\Local\Temp\1winresume.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4052