9ef8bf8e31a49ab9e3d65bee56f6d51b7045636e8807a8f50bf1217c9b956ea8 | Triage

Analysis

max time kernel
134s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2023年11月份工资单/__init__/_asyncio.dll
Size

53KB
MD5

1376af82310869d5a683e356271b4491
SHA1

e60de00d87ff964ff458b5e8fcc98982a9e382c5
SHA256

8397f550c1bc7a5dbb84de403ba810f4b2e47b885ed08e325e23c0af8ecf73f5
SHA512

e8c9897903d6b960966754e13737a289dcc0bfaad3f21085ff233e7bb6dc56e3be3c886b45a58a304384445a633d3c665c90771ee11dcd583dc30d3fcd463fa7
SSDEEP

768:Nfl+a42KKf8SVJ6SwrkaOGUwqPpRVIcsnOhWDG4yq:Nd+afUSaCat3aVIcsnOcyq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4936	3616	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3616	4044	rundll32.exe	87
PID 4044 wrote to memory of 3616	4044	rundll32.exe	87
PID 4044 wrote to memory of 3616	4044	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_asyncio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2023年11月份工资单\__init__\_asyncio.dll,#1
  2⤵
  PID:3616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 628
    3⤵
    - Program crash
    PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3616 -ip 3616
1⤵
PID:3088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads