260a6dbcca13643e8bdffb89c2b935e85c9b27fe89cf0a0c0efb82263bc1bb48

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 20:19

Target

Neuer Ordner/zlib1.dll
Size

85KB
MD5

6b2cfe74852195fb8187f368b74f7635
SHA1

e23e54714355b852726e81a17c444059e0d1339c
SHA256

be93482393ca7d2b440d5559d86268758dadf2f13899978e0271ab1db06b8091
SHA512

6f3ffb5baf6d89ecd76fbdd949327ad12bcfc25b973dc81df498033e3dd65e4bb9774d696e4059abd336dff3cb219ed5a36d38e2e0f63dae2db22c96c359ccd6
SSDEEP

1536:kTHRfzojvOeiRMPrpbAE1ApOal2qk0MGmnToIfUIOcIOYGW3wY:UBzojvOeiRMTtAEepOT0PSTBf6SYfwY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2252	2240	rundll32.exe	28
PID 2240 wrote to memory of 2252	2240	rundll32.exe	28
PID 2240 wrote to memory of 2252	2240	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Neuer Ordner\zlib1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2240 -s 80
  2⤵
  PID:2252