808ccd81cbb014df3475fa04ffc0fae33470a6d2279052dce33349f208558100

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 03:24

Target

ZfUninstall.dll
Size

216KB
MD5

5ddcd23379b752f3f2a060123fd03630
SHA1

c9f0aa653772c7a548c78bfbad1b9d1f0a307f81
SHA256

825d2c2a4503102a063edae2d8372e1f417f2384cda8eaca6aeba5497e9b4c25
SHA512

5742eb44d14094111a52b93e4f4f22c41ef33f77b826f014bf6c4088d05f7148f679e9424348785da8809231a52dbdd9e1f880abe2d702d6b0501156cf60650c
SSDEEP

1536:myYsb1avDvLC9GV8uQD28tfFoNM+NuE+VwbCvoo+htksXplABO9k2Vq8qTKF689V:mKb1arecWD28ZKNuExmUkWyyooT

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1896	1936	rundll32.exe	28
PID 1936 wrote to memory of 1896	1936	rundll32.exe	28
PID 1936 wrote to memory of 1896	1936	rundll32.exe	28
PID 1936 wrote to memory of 1896	1936	rundll32.exe	28
PID 1936 wrote to memory of 1896	1936	rundll32.exe	28
PID 1936 wrote to memory of 1896	1936	rundll32.exe	28
PID 1936 wrote to memory of 1896	1936	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZfUninstall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZfUninstall.dll,#1
  2⤵
  PID:1896