9296e55823555b12ac1d5896ddac964741c43577b3fd44955ce5bf1dd5b89500

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:17

Target

资料/__init__/_lzma.dll
Size

251KB
MD5

b0892745af97c434420961efd8380cd1
SHA1

6a569140d176f63a51951c8bea36bc3c7d232928
SHA256

ce8e5a5383a0c804c0a643c231f48d2ec8cdbffe91258cb2608b840f0b6eb6c2
SHA512

d2f806ca371f3ef7e7da1a6dd870994b7714b807e08c1d8d1aa7ede832cc96bea6c3ad322176322a3c091ec6a2b39549057cbb8628807a256d55d4655e027a88
SSDEEP

6144:51Z+wjJoWUFcwPbdqKNlk8/RO2hzwpbHPq+NZkA/NOihXw7b1qvNEk4/SOMhAkwG:51lTrbsnXtOrf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2300	2692	rundll32.exe	30
PID 2692 wrote to memory of 2300	2692	rundll32.exe	30
PID 2692 wrote to memory of 2300	2692	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\资料\__init__\_lzma.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2692 -s 96
  2⤵
  PID:2300