7bbb458e6579df29118174eb65579f6f02773e8ead9e89b65933191796774617

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 16:07

Target
zlib1.dll
Size 99KB
Sample240524-tkp82abd7y
SHA256 249221a372e83580fa03e789714117c709fc1ce55cb7372640895833916b9f04
MD5 caa9c3b04efe83d93a9e4cac94b8e4a9
SHA1 95499536603ea18daf9be781bd927908d8327ac4
SHA512 faf16f7941e7a4f8a1caa144b0f845c704d38420e3bf549cb8961089dc380d7b08ebf347934366a2ec9b42c69d32e5ac675d56dbed6ebe029cafc2c23410b3b3
SSDEEP 1536:bON+QZJpRJ1glrdXOW0nTEDIptmwRh4p1nToIf6IOqIOqIF4qY+O:0HpRkXOlsIpkwYdTBfI4qIF4qY+O
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2392	2384	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2384	1044	rundll32.exe	28
PID 1044 wrote to memory of 2384	1044	rundll32.exe	28
PID 1044 wrote to memory of 2384	1044	rundll32.exe	28
PID 1044 wrote to memory of 2384	1044	rundll32.exe	28
PID 1044 wrote to memory of 2384	1044	rundll32.exe	28
PID 1044 wrote to memory of 2384	1044	rundll32.exe	28
PID 1044 wrote to memory of 2384	1044	rundll32.exe	28
PID 2384 wrote to memory of 2392	2384	rundll32.exe	29
PID 2384 wrote to memory of 2392	2384	rundll32.exe	29
PID 2384 wrote to memory of 2392	2384	rundll32.exe	29
PID 2384 wrote to memory of 2392	2384	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 224
    3⤵
    - Program crash
    PID:2392

memory/2384-0-0x0000000063080000-0x00000000630A0000-memory.dmp

Download