9ef8bf8e31a49ab9e3d65bee56f6d51b7045636e8807a8f50bf1217c9b956ea8

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 09:52

Target

2023年11月份工资单/__init__/_msi.dll
Size

32KB
MD5

83945e97a7a8fc56039cb1d9d1b15ab9
SHA1

86747b0529d2b98c10c25eb621205e75a967366f
SHA256

ce8963f25624c6080b6d613b60f0f55fd4b3e432a9ff5283b82869827073ce79
SHA512

71615ff41813d4d86513a47b4f0acf46bedf3df9f4c18bf8660c11aa9752ff54b0d76a382b82b740a1af6321e9afb4fb2226c801fc383d0533a3d48569be2443
SSDEEP

768:TcnvrW1RdGsTQwBDql24KaC8xoUAIpd+o7uMzBwQvbkdIc4Gr4eWDG4y5:TKRs5BDql24KaCkBwQTkdIc4Gr4jy5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2816	2688	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2688	2144	rundll32.exe	30
PID 2144 wrote to memory of 2688	2144	rundll32.exe	30
PID 2144 wrote to memory of 2688	2144	rundll32.exe	30
PID 2144 wrote to memory of 2688	2144	rundll32.exe	30
PID 2144 wrote to memory of 2688	2144	rundll32.exe	30
PID 2144 wrote to memory of 2688	2144	rundll32.exe	30
PID 2144 wrote to memory of 2688	2144	rundll32.exe	30
PID 2688 wrote to memory of 2816	2688	rundll32.exe	31
PID 2688 wrote to memory of 2816	2688	rundll32.exe	31
PID 2688 wrote to memory of 2816	2688	rundll32.exe	31
PID 2688 wrote to memory of 2816	2688	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_msi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_msi.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 224
    3⤵
    - Program crash
    PID:2816