2bc78b2cb385b002ee7cf3406e93c7ee336765022f9c3298637dc6496d8fc2fe

Analysis

max time kernel
41s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 19:17

Target

츨12.16ɫ/츨12.16.dll
Size

7KB
MD5

0bbbca7038095d2ca8eff205bb1c7210
SHA1

af89fc4b2dfbfd0a0ce464a171c78009f7caf1b6
SHA256

3b4869d560062b4ea0edd78fba1d798a403b8749a9b32d323058e7e6416ee53e
SHA512

2870cbf3eb75b3812f502b6ab5adae543349b02eb8e62ec1531d0464c9d475e69d4a9e6773a237dc7616f5754ef255903d976cf7d7a5d55e5b2b5043112595d7
SSDEEP

96:yWf0YDrMtyjnyoSvDilH2tBOMrJQOBdFC+orPT3XAUPVAF6GDTnECt6M7N:5iy+o4DiwBOxO2rr3XHPV26Onf6A

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1768 wrote to memory of 1284	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1284	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1284	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1284	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1284	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1284	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 1284	1768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
  2⤵
  PID:1284

memory/1284-54-0x0000000000000000-mapping.dmp

Download
memory/1284-55-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download