3c7bcdd1c407ed6627ca2e234c145474dbd6a3102c9d4d61a124dc74e87f39e9

Analysis

max time kernel
52s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29/03/2023, 05:22

Target

자료 문의의 건.exe
Size

792KB
MD5

d3e0c73690d93037a2015d2671b2498b
SHA1

a58b45ef051e5e2d22a1439e4b440daaf018e11b
SHA256

3c7bcdd1c407ed6627ca2e234c145474dbd6a3102c9d4d61a124dc74e87f39e9
SHA512

075bc6f989a3955bfa28019c0f7b2ea59e5172601cf638c31f542292f91871cf5c17d086e2f9d75773f97ace7da13a7dfe9f3f4f3e8f891d2ad0b596b81e8d0f
SSDEEP

24576:TA5euDufRJdHSO3ESLeUwjzsfdugE6fuo3I6S:s5RubdyOUSqnN6fuo3i

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
472	948	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
948	자료 문의의 건.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	948	자료 문의의 건.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 472	948	자료 문의의 건.exe	28
PID 948 wrote to memory of 472	948	자료 문의의 건.exe	28
PID 948 wrote to memory of 472	948	자료 문의의 건.exe	28
PID 948 wrote to memory of 472	948	자료 문의의 건.exe	28

C:\Users\Admin\AppData\Local\Temp\자료 문의의 건.exe
"C:\Users\Admin\AppData\Local\Temp\자료 문의의 건.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 680
  2⤵
  - Program crash
  PID:472

memory/948-54-0x00000000001F0000-0x00000000002BC000-memory.dmp

Filesize
816KB

Download
memory/948-55-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/948-56-0x0000000001D70000-0x0000000001D90000-memory.dmp

Filesize
128KB

Download
memory/948-57-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/948-58-0x0000000001E80000-0x0000000001E8C000-memory.dmp

Filesize
48KB

Download
memory/948-59-0x0000000005620000-0x00000000056CA000-memory.dmp

Filesize
680KB

Download
memory/948-60-0x0000000001F70000-0x0000000001FA2000-memory.dmp

Filesize
200KB

Download