9296e55823555b12ac1d5896ddac964741c43577b3fd44955ce5bf1dd5b89500 | Triage

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:17

Sharing

Report Analysis Logs

General

Target

资料/__init__/_ctypes.dll
Size

130KB
MD5

a3a99549664137ac7c3d179cefa68abd
SHA1

c02d130cdfb5b04cd4a28509911f806722b8400d
SHA256

8c41d31e49cc8587b44d3b479516d70be84adc7c404e65007eafd74a580d480d
SHA512

d89b8180d4b12fc1dee6fdde1051586b5009a3b063bebbfc153bc4f649442c3daa330cd6f1575ee6d5501ad95eeb8ba678f8ea864eb6386ca67a61d040428383
SSDEEP

3072:x68Dww2Xye3ZL1Fh/4kdftoCdb8yVNRIzVPa:T8fJ1Fh/4kdftoChrVNh

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1908	2408	rundll32.exe	30
PID 2408 wrote to memory of 1908	2408	rundll32.exe	30
PID 2408 wrote to memory of 1908	2408	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\资料\__init__\_ctypes.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2408 -s 128
  2⤵
  PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads