Overview
overview
3Static
static
3样本/App...tj.dll
windows10-2004-x64
1样本/App...tj.dll
windows11-ltsc_2024-x64
1样本/App...l3.dll
windows10-2004-x64
1样本/App...l3.dll
windows11-ltsc_2024-x64
1样本/App...4r.dll
windows10-2004-x64
1样本/App...4r.dll
windows11-ltsc_2024-x64
1样本/App...xo.dll
windows10-2004-x64
1样本/App...xo.dll
windows11-ltsc_2024-x64
1样本/App...zg.dll
windows10-2004-x64
1样本/App...zg.dll
windows11-ltsc_2024-x64
1样本/App...dh.dll
windows10-2004-x64
1样本/App...dh.dll
windows11-ltsc_2024-x64
1样本/App...hf.dll
windows10-2004-x64
1样本/App...hf.dll
windows11-ltsc_2024-x64
1样本/App...od.dll
windows10-2004-x64
1样本/App...od.dll
windows11-ltsc_2024-x64
1样本/App...bi.dll
windows10-2004-x64
1样本/App...bi.dll
windows11-ltsc_2024-x64
1样本/App...lz.dll
windows10-2004-x64
1样本/App...lz.dll
windows11-ltsc_2024-x64
1样本/App...xh.dll
windows10-2004-x64
1样本/App...xh.dll
windows11-ltsc_2024-x64
1样本/Asp...ds.dll
windows10-2004-x64
3样本/Asp...ds.dll
windows11-ltsc_2024-x64
3样本/Inf...pi.dll
windows10-2004-x64
1样本/Inf...pi.dll
windows11-ltsc_2024-x64
1样本/Lea...pi.dll
windows10-2004-x64
1样本/Lea...pi.dll
windows11-ltsc_2024-x64
1样本/Lea...as.dll
windows10-2004-x64
1样本/Lea...as.dll
windows11-ltsc_2024-x64
1样本/Lea...il.dll
windows10-2004-x64
1样本/Lea...il.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
43s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
样本/App_Web_2m0c5qtj.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
样本/App_Web_2m0c5qtj.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
样本/App_Web__admin.cshtml.639c3968.hdcdqyl3.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
样本/App_Web__admin.cshtml.639c3968.hdcdqyl3.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
样本/App_Web__custmerformpreview.cshtml.639c3968.w8bixs4r.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
样本/App_Web__custmerformpreview.cshtml.639c3968.w8bixs4r.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
样本/App_Web__form.cshtml.639c3968.vpoyvxxo.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
样本/App_Web__form.cshtml.639c3968.vpoyvxxo.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral9
Sample
样本/App_Web__index.cshtml.639c3968.lwdowszg.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
样本/App_Web__index.cshtml.639c3968.lwdowszg.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
样本/App_Web_a3cckjdh.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
样本/App_Web_a3cckjdh.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
样本/App_Web_awiukahf.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
样本/App_Web_awiukahf.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
样本/App_Web_c5534dod.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
样本/App_Web_c5534dod.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
样本/App_Web_civvcxbi.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
样本/App_Web_civvcxbi.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral19
Sample
样本/App_Web_trt3t4lz.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
样本/App_Web_trt3t4lz.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
样本/App_global.asax.6ajlkhxh.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
样本/App_global.asax.6ajlkhxh.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
样本/Aspose.Words.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
样本/Aspose.Words.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
样本/InfoEarth.Application.JCYJ.WebApi.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
样本/InfoEarth.Application.JCYJ.WebApi.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
样本/Learun.Application.SSOWebApi.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
样本/Learun.Application.SSOWebApi.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
样本/Learun.Application.WebAreas.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
样本/Learun.Application.WebAreas.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
样本/Learun.Util.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
样本/Learun.Util.dll
Resource
win11ltsc2024-20260709-en
General
- Target 样本/Aspose.Words.dll
- Size 5.7MB
- Sample260723-l5aebabe87
- SHA256 21487ee1794e96236e6f1010a065b6a158e2e2d8cde1f91476fae76e9d540627
- MD5 02c16f8897eeb080e4f55acec427199f
- SHA1 bf304189b32fdf5dcd7d151cc5cbae3edce19f5b
- SHA512 2a4303bf6056905a116d3294f96fa191c35365bcc56b0a6161796e9b439dfdb3113a2335db906744fe71d0357941c9eb1246d83c626d5ee29b603757f56cef66
- SSDEEP 49152:nr3gliCwDWDGkMZZ9i91jp2Afa5xqbFSEYu0n3KqyiU6Q:r3X1DWqvQ96G3sE7LT
- TLSH T182566B1037F94E6EE1AFB73668B11111A7F2F816E763DB8E096072691C32B509E047B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 4444 4480 rundll32.exe 89 PID 4444 wrote to memory of 1556 4444 rundll32.exe 90 PID 1556 wrote to memory of 3404 1556 rundll32.exe 91 PID 3404 wrote to memory of 4552 3404 rundll32.exe 92 PID 4552 wrote to memory of 3304 4552 rundll32.exe 93 PID 3304 wrote to memory of 4620 3304 rundll32.exe 94 PID 4620 wrote to memory of 4084 4620 rundll32.exe 95 PID 4084 wrote to memory of 4468 4084 rundll32.exe 96 PID 4468 wrote to memory of 2912 4468 rundll32.exe 97 PID 2912 wrote to memory of 3720 2912 rundll32.exe 98 PID 3720 wrote to memory of 1368 3720 rundll32.exe 99 PID 1368 wrote to memory of 5732 1368 rundll32.exe 100 PID 5732 wrote to memory of 3236 5732 rundll32.exe 101 PID 3236 wrote to memory of 4924 3236 rundll32.exe 102 PID 4924 wrote to memory of 1824 4924 rundll32.exe 103 PID 1824 wrote to memory of 4660 1824 rundll32.exe 104 PID 4660 wrote to memory of 1004 4660 rundll32.exe 105 PID 1004 wrote to memory of 4652 1004 rundll32.exe 106 PID 4652 wrote to memory of 5916 4652 rundll32.exe 107 PID 5916 wrote to memory of 5656 5916 rundll32.exe 108 PID 5656 wrote to memory of 960 5656 rundll32.exe 109 PID 960 wrote to memory of 2900 960 rundll32.exe 110 PID 2900 wrote to memory of 6024 2900 rundll32.exe 111 PID 6024 wrote to memory of 676 6024 rundll32.exe 112 PID 676 wrote to memory of 5312 676 rundll32.exe 113 PID 5312 wrote to memory of 1456 5312 rundll32.exe 114 PID 1456 wrote to memory of 4636 1456 rundll32.exe 115 PID 4636 wrote to memory of 4348 4636 rundll32.exe 116 PID 4348 wrote to memory of 1328 4348 rundll32.exe 117 PID 1328 wrote to memory of 4760 1328 rundll32.exe 118 PID 4760 wrote to memory of 4404 4760 rundll32.exe 119 PID 4404 wrote to memory of 2092 4404 rundll32.exe 120 PID 2092 wrote to memory of 5276 2092 rundll32.exe 121 PID 5276 wrote to memory of 4900 5276 rundll32.exe 122 PID 4900 wrote to memory of 2504 4900 rundll32.exe 123 PID 2504 wrote to memory of 3424 2504 rundll32.exe 124 PID 3424 wrote to memory of 5664 3424 rundll32.exe 125 PID 5664 wrote to memory of 108 5664 rundll32.exe 126 PID 108 wrote to memory of 256 108 rundll32.exe 127 PID 256 wrote to memory of 3744 256 rundll32.exe 128 PID 3744 wrote to memory of 5724 3744 rundll32.exe 129 PID 5724 wrote to memory of 3784 5724 rundll32.exe 130 PID 3784 wrote to memory of 4184 3784 rundll32.exe 131 PID 4184 wrote to memory of 1896 4184 rundll32.exe 132 PID 1896 wrote to memory of 3492 1896 rundll32.exe 133 PID 3492 wrote to memory of 3584 3492 rundll32.exe 134 PID 3584 wrote to memory of 1532 3584 rundll32.exe 135 PID 1532 wrote to memory of 4528 1532 rundll32.exe 136 PID 4528 wrote to memory of 4972 4528 rundll32.exe 137 PID 4972 wrote to memory of 2980 4972 rundll32.exe 138 PID 2980 wrote to memory of 5588 2980 rundll32.exe 139 PID 5588 wrote to memory of 1856 5588 rundll32.exe 140 PID 1856 wrote to memory of 3820 1856 rundll32.exe 141 PID 3820 wrote to memory of 1748 3820 rundll32.exe 142 PID 1748 wrote to memory of 4340 1748 rundll32.exe 143 PID 4340 wrote to memory of 4384 4340 rundll32.exe 144 PID 4384 wrote to memory of 3676 4384 rundll32.exe 145 PID 3676 wrote to memory of 6076 3676 rundll32.exe 146 PID 6076 wrote to memory of 2636 6076 rundll32.exe 147 PID 2636 wrote to memory of 3912 2636 rundll32.exe 148 PID 3912 wrote to memory of 3540 3912 rundll32.exe 149 PID 3540 wrote to memory of 4072 3540 rundll32.exe 150 PID 4072 wrote to memory of 2348 4072 rundll32.exe 151 PID 2348 wrote to memory of 5400 2348 rundll32.exe 152
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#14⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#15⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#16⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#17⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#18⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#19⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#110⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#111⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#112⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#113⤵
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#114⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#115⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#116⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#117⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#118⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#119⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#120⤵
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#121⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#122⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#123⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#124⤵
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#125⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#126⤵
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#127⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#128⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#129⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#130⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#131⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#132⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#133⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#134⤵
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#135⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#136⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#137⤵
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#138⤵
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#139⤵
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#140⤵
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#141⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#142⤵
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#143⤵
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#144⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#145⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#146⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#147⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#148⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#149⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#150⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#151⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#152⤵
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#153⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#154⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#155⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#156⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#157⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#158⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#159⤵
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#160⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#161⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#162⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#163⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#164⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#165⤵PID:5400
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#166⤵PID:472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#167⤵PID:1140
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#168⤵PID:2756
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#169⤵PID:5616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#170⤵PID:1588
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#171⤵PID:1732
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#172⤵PID:5164
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#173⤵
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#174⤵PID:4808
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#175⤵PID:1864
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#176⤵PID:1384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#177⤵PID:3728
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#178⤵PID:5180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#179⤵PID:844
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#180⤵PID:1180
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#181⤵PID:2508
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#182⤵PID:5580
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#183⤵PID:5172
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#184⤵PID:2220
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#185⤵PID:4956
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#186⤵PID:5384
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#187⤵PID:3460
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#188⤵PID:2768
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#189⤵PID:5856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#190⤵PID:4868
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#191⤵PID:616
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#192⤵PID:2796
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#193⤵PID:2404
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#194⤵PID:2324
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#195⤵PID:2532
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#196⤵
- System Location Discovery: System Language Discovery
PID:5824 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#197⤵PID:5948
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#198⤵PID:3524
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#199⤵PID:3216
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1100⤵PID:3084
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1101⤵PID:3016
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1102⤵PID:2564
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1103⤵PID:3264
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1104⤵PID:2936
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1105⤵PID:2692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1106⤵PID:1900
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1107⤵PID:4476
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1108⤵PID:3832
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1109⤵PID:5628
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1110⤵PID:5316
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1111⤵PID:5168
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1112⤵PID:4856
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1113⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1114⤵PID:1636
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1115⤵PID:716
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1116⤵PID:2472
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1117⤵PID:4692
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1118⤵PID:5700
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1119⤵PID:6092
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1120⤵PID:4160
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1121⤵PID:1720
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\样本\Aspose.Words.dll,#1122⤵PID:2012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-