a6fbd3cbf15de8a9cecbdddf26c0e1ab5b00f2dc116a9e67f791befc7da2d60c

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 13:53

Target

CRACK/zBot crack.dll
Size

1.2MB
MD5

1b1df063887117706ed2db974d7d5fe2
SHA1

9733879630612fcdd9ed3acd26cd491e4000c9f9
SHA256

bbbc950546a8e5616cd8f422abf703d02af9592ae8d6d84b6d33ae610d6a9477
SHA512

bb2d3b7885608f41c9cf6bfaabe6acdeea2b75d40e32c5ce4b1e9953a1da7ab5419eb04284108f4b3a94dd7b92b461d88acfb164c8077385773a50666082ced3
SSDEEP

12288:g+5PKDegc1dg2GmJVjx9KO8TvUya1YpzUSADnbupTjarcqylYoJsPcsT3+AJPIYj:g+5PKDeTjxCaipz/WvytcT3+ek+

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1596	4900	rundll32.exe	85
PID 4900 wrote to memory of 1596	4900	rundll32.exe	85
PID 4900 wrote to memory of 1596	4900	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CRACK\zBot crack.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CRACK\zBot crack.dll",#1
  2⤵
  PID:1596