808ccd81cbb014df3475fa04ffc0fae33470a6d2279052dce33349f208558100

Analysis

max time kernel
131s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 03:24

Target

ZfUninstall.dll
Size

216KB
MD5

5ddcd23379b752f3f2a060123fd03630
SHA1

c9f0aa653772c7a548c78bfbad1b9d1f0a307f81
SHA256

825d2c2a4503102a063edae2d8372e1f417f2384cda8eaca6aeba5497e9b4c25
SHA512

5742eb44d14094111a52b93e4f4f22c41ef33f77b826f014bf6c4088d05f7148f679e9424348785da8809231a52dbdd9e1f880abe2d702d6b0501156cf60650c
SSDEEP

1536:myYsb1avDvLC9GV8uQD28tfFoNM+NuE+VwbCvoo+htksXplABO9k2Vq8qTKF689V:mKb1arecWD28ZKNuExmUkWyyooT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2768	1628	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1628	3388	rundll32.exe	83
PID 3388 wrote to memory of 1628	3388	rundll32.exe	83
PID 3388 wrote to memory of 1628	3388	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZfUninstall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ZfUninstall.dll,#1
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 612
    3⤵
    - Program crash
    PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1628 -ip 1628
1⤵
PID:3048