9296e55823555b12ac1d5896ddac964741c43577b3fd44955ce5bf1dd5b89500 | Triage

Analysis

max time kernel
15s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 13:17

Sharing

Report Analysis Logs

General

Target

资料/__init__/_hashlib.dll
Size

38KB
MD5

61280649d91175908612b944c4b821da
SHA1

30ab92c0e50826b5d8b65e0781582fd5d6c8d9f7
SHA256

1f241abb7e15aade1cca31f43b3199dd3545243b3bbaa31c7a4d93ef6d620692
SHA512

4a60c543925365877f0aeb283d2d4b010e2e2d580dddd2fd01132fd4d85a6ff1c020841187028e54d4bf5d95238ad1720f99aa094e4be5bcf38e5bedb9ac3ef2
SSDEEP

768:Q3zkzB7eddwcZ0sd857xVNl8YjQ/gnRkVIzsITWDG4yDR:F97SdV+LdvjQ/aRkVIzsI+yl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2068	1400	rundll32.exe	29
PID 1400 wrote to memory of 2068	1400	rundll32.exe	29
PID 1400 wrote to memory of 2068	1400	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\资料\__init__\_hashlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1400 -s 112
  2⤵
  PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads