f92f663f8f3a0eb9aa71214253b157153bc4c9b386e4189c00017ec85e9d6913

Analysis

max time kernel
60s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
21/07/2022, 12:17

Target
문의.exe
Size 1.0MB
Sample220721-pf2daafch7
SHA256 f92f663f8f3a0eb9aa71214253b157153bc4c9b386e4189c00017ec85e9d6913
MD5 e1706bb76a8fee54ba313d5dc89914e2
SHA1 69428617a0aab7646c2c82bab14cd4ffbc012ff0
SHA512 50eb5082dbc92e66445f84e47e780af2cdcc1cb23726c3284216febae4a94c28435e233103e3eb5e345304e805ffd11a8889ec3f46c1653a131fcfc57062ed85
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	1676	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	문의.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	문의.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1108	1676	문의.exe	27
PID 1676 wrote to memory of 1108	1676	문의.exe	27
PID 1676 wrote to memory of 1108	1676	문의.exe	27
PID 1676 wrote to memory of 1108	1676	문의.exe	27

C:\Users\Admin\AppData\Local\Temp\문의.exe
"C:\Users\Admin\AppData\Local\Temp\문의.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 700
  2⤵
  - Program crash
  PID:1108

memory/1676-54-0x0000000000140000-0x000000000024E000-memory.dmp

Download

memory/1676-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Download

memory/1676-56-0x0000000002030000-0x000000000204E000-memory.dmp

Download

memory/1676-57-0x00000000004B0000-0x00000000004BA000-memory.dmp

Download

memory/1676-58-0x0000000005EB0000-0x0000000005F46000-memory.dmp

Download

memory/1676-59-0x0000000005F50000-0x0000000005FB2000-memory.dmp

Download