9ef8bf8e31a49ab9e3d65bee56f6d51b7045636e8807a8f50bf1217c9b956ea8

Analysis

max time kernel
129s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2023 09:52

Target

2023年11月份工资单/__init__/_msi.dll
Size

32KB
MD5

83945e97a7a8fc56039cb1d9d1b15ab9
SHA1

86747b0529d2b98c10c25eb621205e75a967366f
SHA256

ce8963f25624c6080b6d613b60f0f55fd4b3e432a9ff5283b82869827073ce79
SHA512

71615ff41813d4d86513a47b4f0acf46bedf3df9f4c18bf8660c11aa9752ff54b0d76a382b82b740a1af6321e9afb4fb2226c801fc383d0533a3d48569be2443
SSDEEP

768:TcnvrW1RdGsTQwBDql24KaC8xoUAIpd+o7uMzBwQvbkdIc4Gr4eWDG4y5:TKRs5BDql24KaCkBwQTkdIc4Gr4jy5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	4644	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 4644	1676	rundll32.exe	86
PID 1676 wrote to memory of 4644	1676	rundll32.exe	86
PID 1676 wrote to memory of 4644	1676	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_msi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_msi.dll,#1
  2⤵
  PID:4644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 644
    3⤵
    - Program crash
    PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4644 -ip 4644
1⤵
PID:4880