ee451d407ec153b9285b4e7303408b6213be711b27a9e5723b88b6e10554968e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 07:52

Target

猪八戒股份有限公司-需求/营业执照/.__MACOS__/.__MACOS__/._MACOS_/python37.dll
Size

3.6MB
MD5

d558d4db5a6bd29a8b60b8aa46e5329a
SHA1

a5036009de7165b1b4721263eae4b240ee689095
SHA256

1cfdd40a9107d89310e4e3b6df5f25f26944b312e61638d014f1b1a8050ccc07
SHA512

5590fbd6c9c81293b21e9da9d35d5177f03ba3d247771e4abef3420420d9024f3a775796d73becd5aeb469df648d3105a016693c6b8f68e8c61399212439eebf
SSDEEP

49152:1TeuSWg7sxvzSxFHYxcim9kOTl8MiYGYwjy9x6xN2BjXISsOIjbXH3EM6nPP8MTj:dcdOMiY+yXCNnjTHUM68wsNyPH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1112	1644	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1112	1644	rundll32.exe	28
PID 1644 wrote to memory of 1112	1644	rundll32.exe	28
PID 1644 wrote to memory of 1112	1644	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\猪八戒股份有限公司-需求\营业执照\.__MACOS__\.__MACOS__\._MACOS_\python37.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1644 -s 100
  2⤵
  - Program crash
  PID:1112