2bc78b2cb385b002ee7cf3406e93c7ee336765022f9c3298637dc6496d8fc2fe

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 19:17

Target

츨12.16ɫ/츨12.16.exe
Size

169KB
MD5

04ab3fe511b4a7465c57fc9e7aedcd3d
SHA1

f678150e525de20a58a2766d52846cc70ffcb622
SHA256

81f15689949e602c3413de07cd00d25baab313dc7a05d5fb05b7de04842a616d
SHA512

e4c5048c1ca4e4a355ff0c85932cb6e67c009f85b79189a0214026521a46744dd592cc3a83246c65a974dce67c570c2288be01150671ebc52ae9584bf10fc393
SSDEEP

3072:uP89l9/zuYu3PvTiqTsKfw6H2vPrzDlNM6FHpU9yP7X4kXq2GzT:cmlzmPvjGHvPn53dBX8p

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

츨12.16.exe

pid process

2040 츨12.16.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 2040 WerFault.exe 츨12.16.exe

pid	process
2040	츨12.16.exe

pid	pid_target	process	target process
2008	2040	WerFault.exe	츨12.16.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

츨12.16.exe

description	pid	process	target process
PID 2040 wrote to memory of 2008	2040	츨12.16.exe	WerFault.exe
PID 2040 wrote to memory of 2008	2040	츨12.16.exe	WerFault.exe
PID 2040 wrote to memory of 2008	2040	츨12.16.exe	WerFault.exe
PID 2040 wrote to memory of 2008	2040	츨12.16.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.exe
"C:\Users\Admin\AppData\Local\Temp\츨12.16ɫ\츨12.16.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 56
  2⤵
  - Program crash
  PID:2008

memory/2008-57-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000000920000-0x0000000000987000-memory.dmp

Filesize
412KB

Download
memory/2040-58-0x0000000000920000-0x0000000000987000-memory.dmp

Filesize
412KB

Download