b62c5f76b05543c1f980ccd972666e8fb769b9fb58fc6a0142d9044fea7d40d8

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 01:35

Target

Set@up#!Files-P@ssw0rD__~2402~_/zlib1.dll
Size

90KB
MD5

7e507af32ca219d2f832cf8d90ca805b
SHA1

4eb56c6f4184efc5a6bb5c7cab46547cfa769744
SHA256

3668c6749db59a6cbc5293d0a4f904f76d6fb5048704449dd53894916f408a57
SHA512

d19c6a0a0798db42490631aa9e30da4200e0b687250daa5ec8bcfe68ae2589a523adeacb6c77544488ddc7610fa84be7477a92c2a27605537a0caec2449c87f1
SSDEEP

1536:pQrGMvscpi5FEexSwqJFQjF2P5kzfWan9USUnToIfAIO6IOq89CVxX:pahexSwqJFQjF2wUrTBf2Iq6AxX

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29
PID 1728 wrote to memory of 1884	1728	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Set@up#!Files-P@ssw0rD__~2402~_\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Set@up#!Files-P@ssw0rD__~2402~_\zlib1.dll,#1
  2⤵
  PID:1884