9296e55823555b12ac1d5896ddac964741c43577b3fd44955ce5bf1dd5b89500

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:17

Target

资料/__init__/_overlapped.dll
Size

43KB
MD5

d7ba0b09acd34163f4f485cccff7349d
SHA1

2855bbd6d7eafa6f295cb1be9e8bc09ded4d4338
SHA256

296e6d85251215032fed5a48bbbf0fdd69f716bc0edce186e6bb9db948c62d05
SHA512

5afed1247e6580bedbb6f2178417e86038793c1cecf730991199af3663abc88229a2ec3a8770065fc59b90072765f45199e7bc161948923344bed865895133ad
SSDEEP

768:TNIUAA4pXLm3L7jR9wlfgk3sMJDhyoY5CKPdRYSpIzJtFWDG4yS:yLBgk3sMJ9qCKYSpIzJtgyS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2240	1840	rundll32.exe	31
PID 1840 wrote to memory of 2240	1840	rundll32.exe	31
PID 1840 wrote to memory of 2240	1840	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\资料\__init__\_overlapped.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1840 -s 96
  2⤵
  PID:2240