9ef8bf8e31a49ab9e3d65bee56f6d51b7045636e8807a8f50bf1217c9b956ea8

Analysis

max time kernel
156s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 09:52

Target

2023年11月份工资单/__init__/_ssl.dll
Size

102KB
MD5

3b45376b9d3bd8464dca131aeac8598c
SHA1

b46de0ee6decdbf40b0a080509e60a379e9cee04
SHA256

1cc9ba51fc53a6f389c9b682f2a9ed5d4d677f937e3b09da851a12c2e8f014ef
SHA512

f7af5d138d4884e6f6226279b39be59c2a8388534564178e66214ce0949113ba4f820dc56dd743da23c57b3f7ef31cbf814d95aca5b84f8427c71ec866ae4153
SSDEEP

1536:eUhPhOVfcmpr3yksoDyJQfoqIB1ZpfE8FdIc47IrMSey6M:eUh5OVfcEr3ykOgoDbZpc8FdIc47OsM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1528	1296	rundll32.exe	86
PID 1296 wrote to memory of 1528	1296	rundll32.exe	86
PID 1296 wrote to memory of 1528	1296	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_ssl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_ssl.dll,#1
  2⤵
  PID:1528