6dbeebffd9de2d1c6c10c7d2bbc221dccf92b8ee4a203f5761d1343e34436a61

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 09:45

Target

츨11.27ɫ/츨11.27.exe
Size

169KB
MD5

04ab3fe511b4a7465c57fc9e7aedcd3d
SHA1

f678150e525de20a58a2766d52846cc70ffcb622
SHA256

81f15689949e602c3413de07cd00d25baab313dc7a05d5fb05b7de04842a616d
SHA512

e4c5048c1ca4e4a355ff0c85932cb6e67c009f85b79189a0214026521a46744dd592cc3a83246c65a974dce67c570c2288be01150671ebc52ae9584bf10fc393
SSDEEP

3072:uP89l9/zuYu3PvTiqTsKfw6H2vPrzDlNM6FHpU9yP7X4kXq2GzT:cmlzmPvjGHvPn53dBX8p

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

츨11.27.exe

pid process

1980 츨11.27.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1020 1980 WerFault.exe 츨11.27.exe

pid	process
1980	츨11.27.exe

pid	pid_target	process	target process
1020	1980	WerFault.exe	츨11.27.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

츨11.27.exe

description	pid	process	target process
PID 1980 wrote to memory of 1020	1980	츨11.27.exe	WerFault.exe
PID 1980 wrote to memory of 1020	1980	츨11.27.exe	WerFault.exe
PID 1980 wrote to memory of 1020	1980	츨11.27.exe	WerFault.exe
PID 1980 wrote to memory of 1020	1980	츨11.27.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 56
2⤵
- Program crash
PID:1020

memory/1020-58-0x0000000000000000-mapping.dmp

Download
memory/1980-54-0x0000000000B30000-0x0000000000B97000-memory.dmp

Filesize
412KB

Download
memory/1980-55-0x0000000000B30000-0x0000000000B97000-memory.dmp

Filesize
412KB

Download
memory/1980-59-0x0000000000B30000-0x0000000000B97000-memory.dmp

Filesize
412KB

Download