6dbeebffd9de2d1c6c10c7d2bbc221dccf92b8ee4a203f5761d1343e34436a61

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 09:45

Target

츨11.27ɫ/츨11.27.dll
Size

1.5MB
MD5

dbac2c9c7545463a542820337e504dd4
SHA1

f1927a37103145678bffefd2437d3c18a9b68831
SHA256

ef022b706eab8542d2cf3be7de64b66cb809509732b08f6e055abeb84bdbba48
SHA512

298dca7f6a9b9557305d435463063b421285d2420f581f28770ffb837dee55ae7ab99547bbd5e4d80da7958d1eb259f0d3c8262bbbd71517d89a0de47795d384
SSDEEP

49152:7wZEkRqxYYYGkMzgBss/g6hIOd9uZNMcC8CFyluyplN1vn:QEnxdHkMz8ss/g6hISuzvCFysyplN

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4644 2636 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4644	2636	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4632 wrote to memory of 2636	4632	rundll32.exe	rundll32.exe
PID 4632 wrote to memory of 2636	4632	rundll32.exe	rundll32.exe
PID 4632 wrote to memory of 2636	4632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 676
    3⤵
    - Program crash
    PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2636 -ip 2636
1⤵
PID:4932