Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 12:09

General

  • Target
    Word图片压缩工具.exe
  • Size 30.0MB
  • Sample261027-pbmdkade27
  • SHA256 73400db9145dcc9c32295b6954b3bb851938a1108a655164a0ef6635c96b22ac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 16 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Word图片压缩工具.exe
    "C:\Users\Admin\AppData\Local\Temp\Word图片压缩工具.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Users\Admin\AppData\Local\Temp\Word图片压缩工具.exe
      "C:\Users\Admin\AppData\Local\Temp\Word图片压缩工具.exe"
      2⤵
      • Loads dropped DLL
      PID:876

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
        • Size 211KB
        • SHA256 ab64835b63093c31975df2692756c8008e7ec190e4aa86f15a713bcc62e1d432
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\_ctypes.pyd
        • Size 138KB
        • SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-console-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-console-l1-1-0.dll
        • Size 23KB
        • SHA256 6d90b8554384cfcfdecea674c7c5f0c7e4864ccab74e2a06c058d45e5a2297b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-datetime-l1-1-0.dll
        • Size 23KB
        • SHA256 cdf54544e21ac3f516f9f348e49a4158b218ceabcbb0a4ef7d62f0f5f4a1e906
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-debug-l1-1-0.dll
        • Size 23KB
        • SHA256 d63cda4163b78b48f33564c4266ad728765e97040207c7e8c308d39d8747ea5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 23KB
        • SHA256 14f444bc532949458f1b3a0f7127522d1923fdf8f6addaa9091ac05a26bf988d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-fibers-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-fibers-l1-1-0.dll
        • Size 23KB
        • SHA256 42a2964624e393329f4ebf9de2a5545332e8c4aaeb7aa79e59bbbd660665b684
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-fibers-l1-1-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-fibers-l1-1-1.dll
        • Size 23KB
        • SHA256 1ab81e94d7bc76d085c8ea5cdff9e8380926cb67e5e2752ac05550bf12e35e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-file-l1-1-0.dll
        • Size 27KB
        • SHA256 3789f07e934afa88e52f3882e5f35bc6773440b277edddc3ef01c215a3a19cf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-file-l1-2-0.dll
        • Size 23KB
        • SHA256 84b0e02f183af995991cf0252ba4e85cf395984207b9ff2b1eeb0177226ddba1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-file-l2-1-0.dll
        • Size 23KB
        • SHA256 d2d1cf46d63eaffd1020a092465db245c4c98666dddd96d013155a2e9d078a52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-handle-l1-1-0.dll
        • Size 23KB
        • SHA256 8f25ac67825b83a1a1da826cfbf486c077909f45c6321382e449b141a50fdddc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-heap-l1-1-0.dll
        • Size 23KB
        • SHA256 63e4aa4df6a5e05ada909d1064e9b18bd9e3abf2826954b72c12ac7f342b8e7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 23KB
        • SHA256 254e6ab0dca00266f976c002cbdeaee65ce47f95334af66764b061e79ea89b7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-kernel32-legacy-l1-1-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-kernel32-legacy-l1-1-1.dll
        • Size 23KB
        • SHA256 c553ec7a3276044ea93d7f9c141a8614265619b8825fa398bcb2473e2106d3df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-libraryloader-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 23KB
        • SHA256 aa7e963e17874282e947e858d46bf41883d63e1a9713b4ffc41f12be5b71b606
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-localization-l1-2-0.dll
        • Size 23KB
        • SHA256 4fcb7d45227fb24d196a2b9f83aeecd36563cfd9e6a30b07f280fc4ae2fab876
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-memory-l1-1-0.dll
        • Size 23KB
        • SHA256 f35ee2e6a0b3a0429a182bfc5344fb4d74fb348b4ff4bea63232db9f93db2f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 23KB
        • SHA256 6c0b719048648f739421079f677f7e78cc1530cbf39ffe3af3a1b9f88c251746
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 23KB
        • SHA256 47f793e41b59f484c19dc14082637058208536f57f4e59dcba8488dbb59c40d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 23KB
        • SHA256 9520d2f762606684aa01a2d82bd3435739bb859b3246668226efec79009f2713
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 23KB
        • SHA256 79a45eaca6b36ab7c8ff8f44a157467681b196b29d36a5fc2eef0b1884622d22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-profile-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-profile-l1-1-0.dll
        • Size 23KB
        • SHA256 5ad000aea2c1d6483ed95cab05640d132c17b6e230b85aa54c199106276e8700
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 23KB
        • SHA256 fdd1e9bd6fc9958808eb8387ebda7c09881724f79cec18ba2ffb030e2eb9c6da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-string-l1-1-0.dll
        • Size 23KB
        • SHA256 63b6ef9b4ce6a0da5c471cc32db8c065fe3fe5c4ae83148668d501920ef332e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-synch-l1-1-0.dll
        • Size 23KB
        • SHA256 b4bd439bfef2d49a4e2efc94e1186e6ffb040652b654e89f7aede112027bae48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-synch-l1-2-0.dll
        • Size 23KB
        • SHA256 072ce0e7f3431c0c6cced99ab30f11c90b401a46631fbe9d5dd295a90bed51d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 23KB
        • SHA256 30fffde4b47f2d6cc2d84980378d59aeddb3e63af77e54e0570ce9337231eda2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-sysinfo-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-sysinfo-l1-2-0.dll
        • Size 23KB
        • SHA256 7159c40ef94300270d7aad8ccaaea122222944c7d7bb89a1672883a61cf26bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-timezone-l1-1-0.dll
        • Size 23KB
        • SHA256 409e74cbb73fa98a15f89b768835cc9c220f7a67ed0246f80bb1aca23140d67b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-core-util-l1-1-0.dll
        • Size 23KB
        • SHA256 ddd7d31ae59bc8c888be63cd043f6eb11bc549a16643f8e570f8142072350d69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-conio-l1-1-0.dll
        • Size 23KB
        • SHA256 902e9cb3129d89683fc755643c33c0c916ff9491eeb1fd4cfedd8c9db93f5f20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-convert-l1-1-0.dll
        • Size 27KB
        • SHA256 cf8ca25d122114b52e4da9768762687cd44be55db10ad44de20dd49841e130a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-environment-l1-1-0.dll
        • Size 23KB
        • SHA256 d55bfa76f4ec65d9cd39a641f57ff5e1a1e9a4ded34eb4e8482d12a5e1f77342
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 23KB
        • SHA256 dea22d94611c31d4a129288dfbe01538a3013b12b41bffcd6261987be401d5b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-heap-l1-1-0.dll
        • Size 23KB
        • SHA256 b39f12499feb1ab6cf9df00440544048d5c90d2093ef72041163bae57ce90f89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-locale-l1-1-0.dll
        • Size 23KB
        • SHA256 9e2c26771235e63c39c108fa4e391607b2fc76b3d9b0bc522419dc996cf20377
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-math-l1-1-0.dll
        • Size 31KB
        • SHA256 800e749d27f78cde8df63f5b6257ec1cd99569c9caf1217c5c4e13b19cea910a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-private-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-private-l1-1-0.dll
        • Size 75KB
        • SHA256 ce6ed64552e8e0635d51115ede4bb250d36b30513c312b5dee61a2c6d88a90e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-process-l1-1-0.dll
        • Size 23KB
        • SHA256 e96aa02467578d8f784bd552998b09cb4b72b569c0d9ed69718addc61945a911
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 27KB
        • SHA256 845d56c381af82faf0f0fec1f454a86adb5a86705448f739915d358972eada56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 27KB
        • SHA256 613959c8257ef6139df3643e7e9bd248234132653aa6e46ba3d15cc6873e8256
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-string-l1-1-0.dll
        • Size 27KB
        • SHA256 442acebdae5b656b8b6315e31c1cad8f72279c8d883229bc7ea5f7bbfe766890
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-time-l1-1-0.dll
        • Size 23KB
        • SHA256 720b7ba50db2747da4a80e90821748d9f1b1f6acf0c410a8d1bc70496d808b54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\api-ms-win-crt-utility-l1-1-0.dll
        • Size 23KB
        • SHA256 4061275e4bb8ce495ff2ee1b1cda44285a0a52d8f30564b838117c3b52dd0ca4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\base_library.zip
        • Size 1.3MB
        • SHA256 6f62a49ec5beded2f0bb84d3bc7e148ae7827bb5813fba0f25a7ff93649ef2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libffi-8.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\libssl-3.dll
        • Size 776KB
        • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pyexpat.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\pyexpat.pyd
        • Size 211KB
        • SHA256 489ec5678cf44e878ce72a84a9149d67dbe926bdcf8d337ee8fd06b04b3f994b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python314.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\python314.dll
        • Size 6.4MB
        • SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        select.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\select.pyd
        • Size 32KB
        • SHA256 5c4103eef14aebd195425d42196895ffb87bf6a25ab4651242bebf0a6b25cf1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tcl86t.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\tcl86t.dll
        • Size 1.8MB
        • SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tk86t.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\tk86t.dll
        • Size 1.5MB
        • SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\ucrtbase.dll
        • Size 1.3MB
        • SHA256 fddd5ed6d8510cf42eaf640b3f0491fc500df0c63faecdd20bfa42221479dae0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unicodedata.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\unicodedata.pyd
        • Size 740KB
        • SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zlib1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b3c2\zlib1.dll
        • Size 142KB
        • SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/876-1111-0x00007FFFD58E0000-0x00007FFFD5909000-memory.dmp