371e893ea727d7c5a44d3ebe082db98a10912f6b722d1ec5d22071d7535a3af1

Analysis

max time kernel
142s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09-08-2023 12:56

Target

“护航亚运”网络安全专项整治行动方案/ucrtbased.dll
Size

2.1MB
MD5

e628baf3be74ffe67e71a27ca3865156
SHA1

05b75dee03400aea8812b9342e764e909667ebbd
SHA256

b9921954681ceb3f01a03071f87aaa33116e0ab0a1532309dced36a0085471b7
SHA512

d5e1a61bb98e35a996cf1d465bc6b922a0aac7d35713852dac43ec54cd34240dcf31d1843c4eed45c251dcde44399b7af1e0262c140577f148b3b706669cfd8e
SSDEEP

24576:kkyjRTK6+N7kMoYU3g3YJY7a1Yd0tERXh7Mzxo2PmivSZXXyY7Gj:kxjbovUwIJfZ2Xh/T6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1208 916 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1208	916	WerFault.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\“护航亚运”网络安全专项整治行动方案\ucrtbased.dll,#1
1⤵
PID:916

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 916 -s 332
2⤵
- Program crash
PID:1208

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 916 -ip 916
1⤵
PID:1640