9296e55823555b12ac1d5896ddac964741c43577b3fd44955ce5bf1dd5b89500 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:17

Sharing

Report Analysis Logs

General

Target

资料/__init__/_decimal.dll
Size

261KB
MD5

0db9a5da7cb238911a7f90d2ad29f454
SHA1

38cafb30da6ce77f8d0ce90638945e1429a6834e
SHA256

9fd0abc3a41ec630eb180c8cfb8df720fe90154d9c603621076872ae3b47ef73
SHA512

59c901cf383143d8bb31ad184f9f7ac72f6bf703ba2fbc3e3c7df7e50499757d7fdc2df337c5438e32b3d7bc75b4628d27d39193a71eb5fe24cd77e622799443
SSDEEP

6144:ktjXkgLLYujhEIJg/7ewj5wB+JiaqWka38LWYAS1wIO:SjXkIlA/6wZTe1wIO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\资料\__init__\_decimal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1824 -s 96
  2⤵
  PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads