ddb62fe8611e6e37b8b37413dea5e5f813f441e1601f8c805787a2d94265a8cb

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 11:56

Target

office2019pjb_9435/office2019pjb/OTool/files/Thunder/zlib1.dll
Size

35KB
MD5

57e11cb59cff3bce88681847d807cf06
SHA1

44e79ea0787acfecba8f73360529d760a8e41cf9
SHA256

a21616050ed5f1bb9e1325089b5d1411da8f12e0060280e5ef41f80eed214066
SHA512

fd43895c72d9c2f001dc1105d2d76288df21fa46b7b8bce8ba9c48f49c48d21f49e9da00906844cee465270739a7c5c024ba04399801b515705a343c7209330f
SSDEEP

768:YR6aROh/8QQAwMydtssQfHFfxKmbK6PAraKBHsEoJKSnnbcuyD7UT9rRK:4c8n7bdt4flfxfKvlBHjoJKSnnouy8Ty

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral25/memory/1652-1-0x00000000215B0000-0x00000000215C6000-memory.dmp	upx
behavioral25/memory/1652-2-0x00000000215B0000-0x00000000215C6000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	1652	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 2316 wrote to memory of 1652	2316	rundll32.exe	28
PID 1652 wrote to memory of 2196	1652	rundll32.exe	29
PID 1652 wrote to memory of 2196	1652	rundll32.exe	29
PID 1652 wrote to memory of 2196	1652	rundll32.exe	29
PID 1652 wrote to memory of 2196	1652	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\zlib1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 224
    3⤵
    - Program crash
    PID:2196

memory/1652-1-0x00000000215B0000-0x00000000215C6000-memory.dmp

Filesize
88KB

Download
memory/1652-0-0x00000000215B0000-0x00000000215C6000-memory.dmp

Filesize
88KB

Download
memory/1652-2-0x00000000215B0000-0x00000000215C6000-memory.dmp

Filesize
88KB

Download