9296e55823555b12ac1d5896ddac964741c43577b3fd44955ce5bf1dd5b89500

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:17

Target

资料/__init__/_elementtree.dll
Size

203KB
MD5

044a447de2403684b7821c2fac0ba51a
SHA1

0ddf50ce102d3c14583c732e87b8b2833ce92ba1
SHA256

586d07244ee85714f094863591c62956b6910636f49696ea744a013acc923668
SHA512

9ed20b4693ddc1c1efff02cede6b076e32d34de16266cc50ce02189373192258b0b729a3601cb143c465cd5ddd446f86e34b90f5b6a3d3bfb717ef0ab5854b2e
SSDEEP

3072:/bt145oz9CaQNbCF8Ncwdl/jr1QPaLQFCJGKSnXSGUhhErNIzAfy6:Zu59aQNdcwdNrK5tZCGDH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1952	2072	rundll32.exe	30
PID 2072 wrote to memory of 1952	2072	rundll32.exe	30
PID 2072 wrote to memory of 1952	2072	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\资料\__init__\_elementtree.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2072 -s 100
  2⤵
  PID:1952