7bbb458e6579df29118174eb65579f6f02773e8ead9e89b65933191796774617

Analysis

max time kernel
141s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 16:07

Target
zlib1.dll
Size 99KB
Sample240524-tkp82abd7y
SHA256 249221a372e83580fa03e789714117c709fc1ce55cb7372640895833916b9f04
MD5 caa9c3b04efe83d93a9e4cac94b8e4a9
SHA1 95499536603ea18daf9be781bd927908d8327ac4
SHA512 faf16f7941e7a4f8a1caa144b0f845c704d38420e3bf549cb8961089dc380d7b08ebf347934366a2ec9b42c69d32e5ac675d56dbed6ebe029cafc2c23410b3b3
SSDEEP 1536:bON+QZJpRJ1glrdXOW0nTEDIptmwRh4p1nToIf6IOqIOqIF4qY+O:0HpRkXOlsIpkwYdTBfI4qIF4qY+O
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4176	2180	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2180	5068	rundll32.exe	84
PID 5068 wrote to memory of 2180	5068	rundll32.exe	84
PID 5068 wrote to memory of 2180	5068	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\zlib1.dll,#1
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 600
    3⤵
    - Program crash
    PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2180 -ip 2180
1⤵
PID:5084

memory/2180-0-0x0000000063080000-0x00000000630A0000-memory.dmp

Download