07f921bf3e922fc3cbfe1a25a4fdc2138d47fa0c070c3bb3bcb7ff20ca94e2ac

Analysis

max time kernel
1560s
max time network
1561s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 18:16

Target
VexyVersionV2/zlib1.dll
Size 87KB
Sample240203-wwjazafda2
SHA256 5e7d2c2ca22641c498cef0f1203f0b2d303cb31b815a94f4d755aea6981ef410
MD5 bc7500767c222aa395a9a4ffc6138571
SHA1 e168238eb5c74363cf7f8120632cb1b34c11b42e
SHA512 abd8718fc5e2d1b2a56be166c18fcd249f727c4383687aaa69d9e38355f8fa116c2862cb962320fe894f233406fc97bef6cdef42a617336a157eb2869d19b2f3
SSDEEP 1536:vbADHM2s2n17hEWUpDZ0CmZnltRFIOcIOs5lhZPnZD:vMDHjs21xUpun/RPSs5zZPnZD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2896	624	rundll32.exe	28
PID 624 wrote to memory of 2896	624	rundll32.exe	28
PID 624 wrote to memory of 2896	624	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VexyVersionV2\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 624 -s 80
  2⤵
  PID:2896