6dbeebffd9de2d1c6c10c7d2bbc221dccf92b8ee4a203f5761d1343e34436a61

Analysis

max time kernel
76s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 09:45

Target

츨11.27ɫ/츨11.27.dll
Size

156KB
MD5

546696fc01d9c7c912da33a7ffecf21a
SHA1

46f3ac49346afd4e85db46ade697f536afd8bee6
SHA256

1b233ec23eccf5cc532e9f1349093ad7dc6b5d14973b1fb09251a21bf080e687
SHA512

7ac984e2d3e91a23a256c6e118d2e83c5049310e5877b436f65a82b4c0e744677ef12d945625eac72f210ad73617133dc10a64b23aa03fcc9513906167174089
SSDEEP

3072:kWxO4AOqXKN18lz1ajwgFxgi9bHb/fERierQ:kH/O+NlYBFxbnERVQ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

672 2036 WerFault.exe rundll32.exe

pid	pid_target	process	target process
672	2036	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1732 wrote to memory of 2036	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2036	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2036	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2036	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2036	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2036	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2036	1732	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 672	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 672	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 672	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 672	2036	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 228
    3⤵
    - Program crash
    PID:672

memory/672-56-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000000000000-mapping.dmp

Download
memory/2036-55-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download