8e0e38ed2f8c46569c0b1d250f3e66b190d256a7fa0824bd5d3e8bf215fb5ce2

Analysis

max time kernel
37s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 22:24

Target

rxbaoV3.29_Y/zlibwapi.dll
Size

138KB
MD5

54789344b07bed58e43851eca47e2b12
SHA1

93c561365bc7f1cbb5385d0323ed81044a6ec276
SHA256

9f8729ac49e0ccea86fe3b1a9b2c3fae9986ecd09db92853e7a588dbda85bf90
SHA512

54d4af3de4b12ff8f25a4596cdb97bb32fd739217f99849bdebe5ca92d801cb5564d4407193bcbfaf8118e5d3391543a80ff08371e28c35c2c091d9ff90a3692
SSDEEP

3072:rjdSKCC+FzNehv8Rqiq9+yVojaylvjTBfxvA:rjdS8czEuqFVojzlvjTBJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1956 884 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1956	884	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1636 wrote to memory of 884	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 884	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 884	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 884	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 884	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 884	1636	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 884	1636	rundll32.exe	rundll32.exe
PID 884 wrote to memory of 1956	884	rundll32.exe	WerFault.exe
PID 884 wrote to memory of 1956	884	rundll32.exe	WerFault.exe
PID 884 wrote to memory of 1956	884	rundll32.exe	WerFault.exe
PID 884 wrote to memory of 1956	884	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\zlibwapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\zlibwapi.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 224
    3⤵
    - Program crash
    PID:1956

memory/884-54-0x0000000000000000-mapping.dmp

Download
memory/884-55-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000000000000-mapping.dmp

Download