ddb62fe8611e6e37b8b37413dea5e5f813f441e1601f8c805787a2d94265a8cb

Analysis

max time kernel
134s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 11:56

Target

office2019pjb_9435/office2019pjb/OTool/files/Thunder/zlib1.dll
Size

35KB
MD5

57e11cb59cff3bce88681847d807cf06
SHA1

44e79ea0787acfecba8f73360529d760a8e41cf9
SHA256

a21616050ed5f1bb9e1325089b5d1411da8f12e0060280e5ef41f80eed214066
SHA512

fd43895c72d9c2f001dc1105d2d76288df21fa46b7b8bce8ba9c48f49c48d21f49e9da00906844cee465270739a7c5c024ba04399801b515705a343c7209330f
SSDEEP

768:YR6aROh/8QQAwMydtssQfHFfxKmbK6PAraKBHsEoJKSnnbcuyD7UT9rRK:4c8n7bdt4flfxfKvlBHjoJKSnnouy8Ty

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral26/memory/4336-0-0x00000000215B0000-0x00000000215C6000-memory.dmp	upx
behavioral26/memory/4336-1-0x00000000215B0000-0x00000000215C6000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	4336	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 4336	5872	rundll32.exe	83
PID 5872 wrote to memory of 4336	5872	rundll32.exe	83
PID 5872 wrote to memory of 4336	5872	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\office2019pjb_9435\office2019pjb\OTool\files\Thunder\zlib1.dll,#1
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 604
    3⤵
    - Program crash
    PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4336 -ip 4336
1⤵
PID:5096

memory/4336-0-0x00000000215B0000-0x00000000215C6000-memory.dmp

Filesize
88KB

Download
memory/4336-1-0x00000000215B0000-0x00000000215C6000-memory.dmp

Filesize
88KB

Download