b929b4efc4af3e5e34b74e4ed2fda0e46c159742b2f0a9117b54516a25c75a4d

Resubmissions

13/07/2025, 16:46

13/07/2025, 16:45

01/04/2025, 01:21

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
13/07/2025, 16:46

Target
AI自动化办公表格制作生成工具安装包/双击安装.exe
Size 253KB
Sample250713-vae6raswet
SHA256 a8a42814c253ca5e93e81be5bd69149ff71b9ac3024420614fba37fb0834b3c0
MD5 c20383afabfbd60298b6b2385237a008
SHA1 902438f6bcc919f98b195f4de2560a311ff5dcd0
SHA512 e844938501c7fe3da490e5d5b0172077829715d137ee1f9b770bbaf1ae1700ed0cb532da819beeba04ce7df926b9c81bc194bf7d5c3eb8c57625dc4aa8dc2bd2
SSDEEP 3072:oehT3vurb+DJte4ytrYwFK8zk9J7TL6WxBEC7AVUAQ/J5foY46pjQ02WO9Fc43Lx:Xz4qDJte4yZjQ8zknFnkX+zohQs9BZ2u
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Blocklisted process makes network request 8 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 464 set thread context of 3420	464	双击安装.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 3420	464	双击安装.exe	81
PID 464 wrote to memory of 3420	464	双击安装.exe	81
PID 464 wrote to memory of 3420	464	双击安装.exe	81

C:\Users\Admin\AppData\Local\Temp\AI自动化办公表格制作生成工具安装包\双击安装.exe
"C:\Users\Admin\AppData\Local\Temp\AI自动化办公表格制作生成工具安装包\双击安装.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe
  2⤵
  - Blocklisted process makes network request
  PID:3420