ee451d407ec153b9285b4e7303408b6213be711b27a9e5723b88b6e10554968e

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 07:52

Target

猪八戒股份有限公司-需求/营业执照/.__MACOS__/.__MACOS__/._MACOS_/_ctypes.dll
Size

130KB
MD5

9e18aca18e4ece1c187f8c0cd12a5c8f
SHA1

a8ba36a9eea969d722a9ae90139d4d59f643f951
SHA256

3351627469ea8965b08bafc9de18d1d890479357df6bc8917f7218535e02f211
SHA512

237b0ef23d0a91014581b94f5c7696da1ab3c1c3a51f6ffe10787c65dc4f5a90d1760e4088afc9acc27bae7f159a32fa3e7a9b15daba5950751932683e9373b3
SSDEEP

3072:hFHggvfQuiAnxL3RIF5Hfbr/IHWfxI1VPm:sgvZnxhw5HfbroKX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2248	2224	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2248	2224	rundll32.exe	28
PID 2224 wrote to memory of 2248	2224	rundll32.exe	28
PID 2224 wrote to memory of 2248	2224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\猪八戒股份有限公司-需求\营业执照\.__MACOS__\.__MACOS__\._MACOS_\_ctypes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2224 -s 132
  2⤵
  - Program crash
  PID:2248