2bc78b2cb385b002ee7cf3406e93c7ee336765022f9c3298637dc6496d8fc2fe

Analysis

max time kernel
200s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 19:17

Target

츨12.16ɫ/츨12.16.dll
Size

156KB
MD5

546696fc01d9c7c912da33a7ffecf21a
SHA1

46f3ac49346afd4e85db46ade697f536afd8bee6
SHA256

1b233ec23eccf5cc532e9f1349093ad7dc6b5d14973b1fb09251a21bf080e687
SHA512

7ac984e2d3e91a23a256c6e118d2e83c5049310e5877b436f65a82b4c0e744677ef12d945625eac72f210ad73617133dc10a64b23aa03fcc9513906167174089
SSDEEP

3072:kWxO4AOqXKN18lz1ajwgFxgi9bHb/fERierQ:kH/O+NlYBFxbnERVQ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5088 1304 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5088	1304	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4132 wrote to memory of 1304	4132	rundll32.exe	rundll32.exe
PID 4132 wrote to memory of 1304	4132	rundll32.exe	rundll32.exe
PID 4132 wrote to memory of 1304	4132	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4132

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.dll,#1
2⤵
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 608
3⤵
- Program crash
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1304 -ip 1304
1⤵
PID:4336