9296e55823555b12ac1d5896ddac964741c43577b3fd44955ce5bf1dd5b89500

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:17

Target

资料/__init__/_multiprocessing.dll
Size

28KB
MD5

128d7219b4663193f4e6413990ee4c03
SHA1

47257e7dd99c031c34ad59eb5d6a97d81cd2f09f
SHA256

2249fbe78eb3fa06b4bde9f1a4b0441c3977c86e0f95faa3fb605224280be84f
SHA512

50e355b0f95b7ea0120667787a01c7783514131caf468f520624cee7af380ece35164dd313778d4280c12eb30ef368478e89791614d1dd354cb3670f9653fad1
SSDEEP

384:BPzDKCI1xWyQ+78M1Y5FoTewHJ4V2ZirwIzkBLdX8NnYPLxDG4y8NSB:BQQ+7so6wy2ZirwIzktdWWDG4yd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2828	2768	rundll32.exe	31
PID 2768 wrote to memory of 2828	2768	rundll32.exe	31
PID 2768 wrote to memory of 2828	2768	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\资料\__init__\_multiprocessing.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2768 -s 96
  2⤵
  PID:2828