9ef8bf8e31a49ab9e3d65bee56f6d51b7045636e8807a8f50bf1217c9b956ea8

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
16/11/2023, 09:52

Target

2023年11月份工资单/__init__/_asyncio.dll
Size

53KB
MD5

1376af82310869d5a683e356271b4491
SHA1

e60de00d87ff964ff458b5e8fcc98982a9e382c5
SHA256

8397f550c1bc7a5dbb84de403ba810f4b2e47b885ed08e325e23c0af8ecf73f5
SHA512

e8c9897903d6b960966754e13737a289dcc0bfaad3f21085ff233e7bb6dc56e3be3c886b45a58a304384445a633d3c665c90771ee11dcd583dc30d3fcd463fa7
SSDEEP

768:Nfl+a42KKf8SVJ6SwrkaOGUwqPpRVIcsnOhWDG4yq:Nd+afUSaCat3aVIcsnOcyq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	2904	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2904	1136	rundll32.exe	28
PID 1136 wrote to memory of 2904	1136	rundll32.exe	28
PID 1136 wrote to memory of 2904	1136	rundll32.exe	28
PID 1136 wrote to memory of 2904	1136	rundll32.exe	28
PID 1136 wrote to memory of 2904	1136	rundll32.exe	28
PID 1136 wrote to memory of 2904	1136	rundll32.exe	28
PID 1136 wrote to memory of 2904	1136	rundll32.exe	28
PID 2904 wrote to memory of 2340	2904	rundll32.exe	29
PID 2904 wrote to memory of 2340	2904	rundll32.exe	29
PID 2904 wrote to memory of 2340	2904	rundll32.exe	29
PID 2904 wrote to memory of 2340	2904	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_asyncio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_asyncio.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 224
    3⤵
    - Program crash
    PID:2340