30aecb1d0bb7c6f8de3f21937ff121ccfee96e0454a1e9a156fefbf8accc8770

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 08:22

Target

$PLUGINSDIR/Zip.dll
Size

76KB
MD5

bd448b748b6fb2fc268f297363ef69e5
SHA1

0c33557703b39928d19520651001607724f5cf8d
SHA256

b3a67c05d7788b1310b342bea37d69a84d9c7997c729f489f9602148f9a6d708
SHA512

555f049387a924c1a3feb38582abb3c5b238df5975c4f739690e2bad06ce5bfce02c2deb46816aacbf73e76292382e8974484e9886f079de69ddad1268a0ea0d
SSDEEP

768:2qzEOfLo2T0pHES42P2wsSrSlAKL0RvTZTEeo9L1Po0OQuiSKcKysNU3her9dohv:2hQspHrXK5eKO5KysyxAd4CiR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4408	2976	WerFault.exe	42

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 2976	64	rundll32.exe	42
PID 64 wrote to memory of 2976	64	rundll32.exe	42
PID 64 wrote to memory of 2976	64	rundll32.exe	42

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Zip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Zip.dll,#1
  2⤵
  PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 600
    3⤵
    - Program crash
    PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2976 -ip 2976
1⤵
PID:5076