9ef8bf8e31a49ab9e3d65bee56f6d51b7045636e8807a8f50bf1217c9b956ea8

Analysis

max time kernel
146s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 09:52

Target

2023年11月份工资单/__init__/_sqlite3.dll
Size

65KB
MD5

41752c3179d3bebd6d449444580663cc
SHA1

fd1bfaca58656d19ff718bf440a5190856510fe5
SHA256

1d1797a53b43eced3e2a87bd6b50a6ade67214a3a870e9a5bd6bab144b3907f7
SHA512

ea06eae58915755588a9529a0994458a1fc743353bfe0df632f2b24d7f4443ed58b8b046dbf5ec1a3092bf96e9e54bf5f1f9be2d94e072146d32d79303ffe8b8
SSDEEP

1536:jzScfyNB6uNPiRwt+83zRUg6wQiZSKG0nz9AwVIcsQMi7y25:ysm6yiRGmC4KPz9AwVIcsQD5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4660	2116	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 2116	3344	rundll32.exe	88
PID 3344 wrote to memory of 2116	3344	rundll32.exe	88
PID 3344 wrote to memory of 2116	3344	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_sqlite3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_sqlite3.dll,#1
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 628
    3⤵
    - Program crash
    PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2116 -ip 2116
1⤵
PID:4324